Edit tour

Windows Analysis Report
Soltix.exe

Overview

General Information

Sample name:	Soltix.exe
Analysis ID:	1554230
MD5:	48ce883bd2800dd273a3575401bd3951
SHA1:	4a812a8d93af507c125d7437cf03b867a422c475
SHA256:	b175f6cfe1788b38d8e1126358e9c5361539ff1232e1583d0482659093fe47be
Tags:	exeuser-likeastar20
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops large PE files

Protects its processes via BreakOnTermination flag

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Classification

Process Tree

System is w10x64

Soltix.exe (PID: 6860 cmdline: "C:\Users\user\Desktop\Soltix.exe" MD5: 48CE883BD2800DD273A3575401BD3951)

KWW0dmvnSt.exe (PID: 3648 cmdline: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe MD5: E8CF20F76C429496C2C19DFAB48D6916)

cmd.exe (PID: 2656 cmdline: C:\Windows\system32\cmd.exe /d /s /c "WMIC csproduct get UUID" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1136 cmdline: WMIC csproduct get UUID MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 1836 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1912 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 5820 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2688 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 6012 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1036 cmdline: wmic bios get serialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 4592 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell wininit.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6984 cmdline: powershell wininit.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

wininit.exe (PID: 4020 cmdline: "C:\Windows\system32\wininit.exe" MD5: 3588C1AC44DCE86A043310B07679C508)

cleanup

Sigma Signatures

System Summary

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell wininit.exe, CommandLine: powershell wininit.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell wininit.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell wininit.exe, ProcessId: 6984, ProcessName: powershell.exe

Source: C:\Users\user\Desktop\Soltix.exe	File created: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	File created: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\LICENSE.electron.txt			Jump to behavior

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr

Source: C:\Users\user\Desktop\Soltix.exe	File opened: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\app.asar.unpacked\node_modules	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	File opened: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\locales	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	File opened: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	File opened: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\app-64.7z	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	File opened: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	File opened: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\app.asar.unpacked	Jump to behavior

Source: C:\Users\user\Desktop\Soltix.exe	File dump: KWW0dmvnSt.exe.0.dr 186493440			Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	File dump: KWW0dmvnSt.exe0.0.dr 186493440			Jump to dropped file

Source: KWW0dmvnSt.exe.0.dr	Static PE information: Number of sections : 15 > 10
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: Number of sections : 15 > 10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2036:120:WilError_03

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: unknown	Process created: C:\Users\user\Desktop\Soltix.exe "C:\Users\user\Desktop\Soltix.exe"
Source: C:\Users\user\Desktop\Soltix.exe	Process created: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "WMIC csproduct get UUID"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC csproduct get UUID
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell wininit.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell wininit.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wininit.exe "C:\Windows\system32\wininit.exe"
Source: C:\Users\user\Desktop\Soltix.exe	Process created: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "WMIC csproduct get UUID"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell wininit.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC csproduct get UUID	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get serialnumber	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell wininit.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wininit.exe "C:\Windows\system32\wininit.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: KWW0dmvnSt.exe.0.dr	Static PE information: section name: .gxfg
Source: KWW0dmvnSt.exe.0.dr	Static PE information: section name: .retplne
Source: KWW0dmvnSt.exe.0.dr	Static PE information: section name: .rodata
Source: KWW0dmvnSt.exe.0.dr	Static PE information: section name: CPADinfo
Source: KWW0dmvnSt.exe.0.dr	Static PE information: section name: LZMADEC
Source: KWW0dmvnSt.exe.0.dr	Static PE information: section name: _RDATA
Source: KWW0dmvnSt.exe.0.dr	Static PE information: section name: malloc_h
Source: KWW0dmvnSt.exe.0.dr	Static PE information: section name: prot
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: section name: .gxfg
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: section name: .retplne
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: section name: .rodata
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: section name: CPADinfo
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: section name: LZMADEC
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: section name: _RDATA
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: section name: malloc_h
Source: KWW0dmvnSt.exe0.0.dr	Static PE information: section name: prot
Source: node.napi.node.0.dr	Static PE information: section name: _RDATA
Source: node_sqlite3.node.0.dr	Static PE information: section name: _RDATA

Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1423136
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/1423136dumpTranslatedShadersWrite
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/342316794
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/345244067
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096371
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096371expandIntegerPowExpressionsThe
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096454
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096464
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096480
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096530
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096539
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096601
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096608
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096608allowES3OnFL100Allow
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096643
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096648
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096661
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096758
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096838
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40096838cacheCompiledShaderEnable
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644593
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644627
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644627skipVSConstantRegisterZeroIn
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644663
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644715
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644730
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644740
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644747
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644776
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644912
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/40644912enableTranslatedShaderSubstitutionCheck
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/41488637
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/41493495
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/42260492
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/42260591
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/42260722
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/42261226
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/42261713
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/42261756
Source: libGLESv2.dll.0.dr	String found in binary or memory: http://anglebug.com/42261881

Source: C:\Users\user\Desktop\Soltix.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Soltix.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmmouse.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	File opened / queried: C:\usr\bin\vmware-toolbox-cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	File opened / queried: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	File opened / queried: C:\WINDOWS\system32\drivers\VBoxMouse.sys	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2102			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1189			Jump to behavior

Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.node	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Soltix.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4836	Thread sleep count: 2102 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4976	Thread sleep count: 1189 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6244	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: libGLESv2.dll.0.dr	Binary or memory string: VMware
Source: libGLESv2.dll.0.dr	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSDKVersion() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (!isMesa && IsMaliT8xxOrOlder(functions)) \|\| (!isMesa && IsMaliG31OrOlder(functions))
Source: libGLESv2.dll.0.dr	Binary or memory string: ZAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTest

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	53 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\KWW0dmvnSt.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj5436.tmp\nsis7z.dll	0%	ReversingLabs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Soltix.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\KWW0dmvnSt.exe

C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\ffmpeg.dll

C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\icudtl.dat

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bujbue3b.svu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h24rlgcd.rpa.ps1

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\KWW0dmvnSt.exe

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\LICENSES.chromium.html

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\ffmpeg.dll

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\icudtl.dat

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\libEGL.dll

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\libGLESv2.dll

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\locales\af.pak

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\locales\am.pak

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\locales\ar.pak

C:\Users\user\AppData\Local\Temp\nsj5436.tmp\7z-out\locales\bg.pak

Windows Analysis Report
Soltix.exe

Source	Detection	Scanner	Label
http://anglebug.com/42262161	0%	Avira URL Cloud	safe
http://skbug.com/9491	0%	Avira URL Cloud	safe
http://anglebug.com/42261756	0%	Avira URL Cloud	safe
http://anglebug.com/42262286	0%	Avira URL Cloud	safe
https://anglebug.com/42265794	0%	Avira URL Cloud	safe
http://anglebug.com/40096661	0%	Avira URL Cloud	safe
http://anglebug.com/42263010	0%	Avira URL Cloud	safe
http://anglebug.com/42262605	0%	Avira URL Cloud	safe
https://anglebug.com/42265792	0%	Avira URL Cloud	safe
http://anglebug.com/42267057	0%	Avira URL Cloud	safe
http://anglebug.com/40644627skipVSConstantRegisterZeroIn	0%	Avira URL Cloud	safe
http://anglebug.com/42262287	0%	Avira URL Cloud	safe
https://issuetracker.google.com/336844257	0%	Avira URL Cloud	safe
http://anglebug.com/42262166	0%	Avira URL Cloud	safe
http://anglebug.com/42264287forceRobustResourceInitForce-enable	0%	Avira URL Cloud	safe
https://anglebug.com/42265782	0%	Avira URL Cloud	safe
http://anglebug.com/42264571forceInitShaderVariablesForce-enable	0%	Avira URL Cloud	safe
http://anglebug.com/42264193forceGlErrorCheckingForce	0%	Avira URL Cloud	safe
http://anglebug.com/41493495	0%	Avira URL Cloud	safe
http://anglebug.com/42266652	0%	Avira URL Cloud	safe
https://anglebug.com/42266070	0%	Avira URL Cloud	safe
http://anglebug.com/42261882	0%	Avira URL Cloud	safe
http://anglebug.com/42261881	0%	Avira URL Cloud	safe
https://issuetracker.google.com/349489248	0%	Avira URL Cloud	safe
http://anglebug.com/42267082	0%	Avira URL Cloud	safe
https://anglebug.com/42267038	0%	Avira URL Cloud	safe
https://anglebug.com/42266748	0%	Avira URL Cloud	safe
https://anglebug.com/42266745	0%	Avira URL Cloud	safe
http://anglebug.com/42262506	0%	Avira URL Cloud	safe
https://anglebug.com/42266740	0%	Avira URL Cloud	safe
http://anglebug.com/42263031	0%	Avira URL Cloud	safe
https://anglebug.com/42266183	0%	Avira URL Cloud	safe
http://anglebug.com/42266666	0%	Avira URL Cloud	safe
http://anglebug.com/42263158	0%	Avira URL Cloud	safe
http://anglebug.com/42264008	0%	Avira URL Cloud	safe
http://anglebug.com/42263969	0%	Avira URL Cloud	safe
http://anglebug.com/42266231enableShaderSubstitutionCheck	0%	Avira URL Cloud	safe
http://anglebug.com/42263580disableDrawBuffersIndexedDisable	0%	Avira URL Cloud	safe
http://anglebug.com/42266842uncurrentEglSurfaceUponSurfaceDestroyMake	0%	Avira URL Cloud	safe
http://anglebug.com/40096454	0%	Avira URL Cloud	safe
http://anglebug.com/42263049	0%	Avira URL Cloud	safe
http://anglebug.com/42262249	0%	Avira URL Cloud	safe
http://anglebug.com/42263960	0%	Avira URL Cloud	safe
http://anglebug.com/42265516	0%	Avira URL Cloud	safe
http://anglebug.com/42264669	0%	Avira URL Cloud	safe
http://anglebug.com/40644663	0%	Avira URL Cloud	safe
http://anglebug.com/42261713	0%	Avira URL Cloud	safe
https://anglebug.com/42265636	0%	Avira URL Cloud	safe
https://anglebug.com/42265877	0%	Avira URL Cloud	safe
https://anglebug.com/42265637	0%	Avira URL Cloud	safe
https://issuetracker.google.com/347601787	0%	Avira URL Cloud	safe
http://anglebug.com/42266842	0%	Avira URL Cloud	safe
http://anglebug.com/42262247	0%	Avira URL Cloud	safe
http://anglebug.com/42265878	0%	Avira URL Cloud	safe
http://anglebug.com/42265407	0%	Avira URL Cloud	safe
https://anglebug.com/42266842	0%	Avira URL Cloud	safe
http://anglebug.com/42265995	0%	Avira URL Cloud	safe
http://anglebug.com/42266602	0%	Avira URL Cloud	safe
http://anglebug.com/42264422	0%	Avira URL Cloud	safe
http://anglebug.com/42266725	0%	Avira URL Cloud	safe
http://anglebug.com/42266232disableProgramCachingDisables	0%	Avira URL Cloud	safe
http://anglebug.com/40096758	0%	Avira URL Cloud	safe
http://anglebug.com/42263580	0%	Avira URL Cloud	safe
http://anglebug.com/42261924allowClearForRobustResourceInitSome	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://anglebug.com/42261756	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42262605	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/answer/6098869	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
http://anglebug.com/40096661	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://skbug.com/9491	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/284462263	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42267057	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42262161	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/550292	libGLESv2.dll.0.dr	false		high
https://anglebug.com/42265794	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42263010	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42265792	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42262286	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42262166	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42262287	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42264287forceRobustResourceInitForce-enable	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/883276	libGLESv2.dll.0.dr	false		high
https://chrome.google.com/webstore?hl=swCtrl$1	sw.pak.0.dr	false		high
http://anglebug.com/42264193forceGlErrorCheckingForce	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1356053	libGLESv2.dll.0.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
https://crbug.com/705865	libGLESv2.dll.0.dr	false		high
http://crbug.com/110263	libGLESv2.dll.0.dr	false		high
https://issuetracker.google.com/336844257	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42265782	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/41493495	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/40644627skipVSConstantRegisterZeroIn	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42264571forceInitShaderVariablesForce-enable	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42266652	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42261881	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42261882	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42266070	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/255411748	libGLESv2.dll.0.dr	false		high
https://www.google.com/chrome/privacy/eula_text.html&AideG	fr.pak.0.dr	false		high
http://anglebug.com/42262506	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/flutter/flutter/issues/47804	libGLESv2.dll.0.dr	false		high
https://crbug.com/593024	libGLESv2.dll.0.dr	false		high
https://crbug.com/1137851	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42267082	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42266748	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42266745	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/349489248	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42267038	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42266740	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42263031	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/161903006	libGLESv2.dll.0.dr	false		high
https://crbug.com/1300575	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42266666	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42266183	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/710443	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42263158	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1042393	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42264008	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42266231enableShaderSubstitutionCheck	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1060012	libGLESv2.dll.0.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
https://issuetracker.google.com/155487768	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42263969	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42263580disableDrawBuffersIndexedDisable	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/642605	libGLESv2.dll.0.dr	false		high
http://anglebug.com/40096454	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/a/answer/9122284	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
http://anglebug.com/42266842uncurrentEglSurfaceUponSurfaceDestroyMake	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42263960	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/345244067	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42263049	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/40644663	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/650547callClearTwiceUsing	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42262249	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42264669	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42265516	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42261713	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/1420130	libGLESv2.dll.0.dr	false		high
https://issuetracker.google.com/258207403	libGLESv2.dll.0.dr	false		high
https://chrome.google.com/webstore?hl=sw&category=theme81https://myactivity.google.com/myactivity/?u	sw.pak.0.dr	false		high
https://www.google.com/chrome/privacy/eula_text.htmlInasimamiwa	sw.pak.0.dr	false		high
https://anglebug.com/42265636	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/1181068	libGLESv2.dll.0.dr	false		high
https://anglebug.com/42265637	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42265877	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/347601787	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/42266842	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42266842	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42264422	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42265995	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://passwords.google.comCompte	fr.pak.0.dr	false		high
http://anglebug.com/42266725	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42262247	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42265878	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42266602	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42265407	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://int3.de/	elevate.exe.0.dr	false		high
http://anglebug.com/42266232disableProgramCachingDisables	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/309028728	libGLESv2.dll.0.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
https://policies.google.com/	zh-CN.pak.0.dr, fr.pak.0.dr, sw.pak.0.dr	false		high
http://anglebug.com/40096758	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/1181193	libGLESv2.dll.0.dr	false		high
http://anglebug.com/42263580	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/42261924allowClearForRobustResourceInitSome	libGLESv2.dll.0.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554230
Start date and time:	2024-11-12 09:18:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Critical Process Termination
Sample name:	Soltix.exe
Detection:	MAL
Classification:	mal48.evad.winEXE@30/110@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\2oetaFWZeG8fCqRghv3OSuwbZdJ\d3dcompiler_47.dll	Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Prismifyr_Installer_v2.1 Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	svchost.exe	Get hash	malicious	Unknown	Browse
	JaborSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	DungeOfDestiny Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.7307872139132228
Encrypted:	false
SSDEEP:	3:NlllulkX:NllU
MD5:	C71A2ECB2F33053E0001F23F1C13DF8F
SHA1:	DCC5DA2329F5481EE748DBCCC346E06BD6F4F843
SHA-256:	A122EDC09F664F32F7A906B2F7E8C4E4AAEA97CCF7BC231F6B9D0612BEBBD3C8
SHA-512:	C0EDCEF10A013F12C981F2B078996948E8B698D8AC2C37DC9566C3C2A25B0E56D5EE7B27C4BD8519414BD15251F94F66418D35B67A23D6875AABD35B19E1CD5F
Malicious:	false
Preview:	@...e...........................................................

Process:	C:\Users\user\Desktop\Soltix.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	186493440
Entropy (8bit):	6.751281878516557
Encrypted:	false
SSDEEP:	1572864:LNvGCNRixbPlrp4MpeU4cpVblbtHvJb7ZlBS3bQiOFx++/305WNejZlqE6N0okBN:LmbJBrh5c
MD5:	E8CF20F76C429496C2C19DFAB48D6916
SHA1:	246E312D528FB9FE1A448B38471A7667B06A6246
SHA-256:	600805B36D297D54C9F8AC4E1623BCA3F0549B1D6E58C75159714EBE35449EDF
SHA-512:	02D1599719CB9A619826A2434184834FF864AC5DB4682B51CAA1AA431C9B52BA01EFE004265817C6DC6C48046370D2118CEA07041E4385AFA94A9A61DABD4775
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f..........".......%..........2.........@..............................\...........`......................................... R..`......h.....G..........I..........pM..'..`K......................@F..(.....%.@............................................text...C.%.......%................. ..`.rdata........%.......%.............@..@.data.....H........................@....pdata....I...... I..L..............@..@.gxfg....B....F..D...l..............@..@.retplne.....0G..........................rodata......@G..................... ..`.tls.........`G.....................@...CPADinfo8....pG.....................@...LZMADEC.......G..................... ..`_RDATA........G.....................@..@malloc_h......G..................... ..`prot..........G.....................@..@.rsrc........G.....................@..@.reloc...'...pM..(..................@..B................

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999864154319864
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Soltix.exe
File size:	85'648'429 bytes
MD5:	48ce883bd2800dd273a3575401bd3951
SHA1:	4a812a8d93af507c125d7437cf03b867a422c475
SHA256:	b175f6cfe1788b38d8e1126358e9c5361539ff1232e1583d0482659093fe47be
SHA512:	5c83558990792170604619c5b9e0f87348fc02f5fd02444f4f153b42c3a7d877dba35e5436962332a5f229413b891546be1eab11df39e457f4d4ed8ffefaf411
SSDEEP:	1572864:6Snyk/h70iT9EYCe+v7vsaLugl5tgkP0fCep47FWcOBD41FES3bk787:6eymqfUW/P7WvOtbh7
TLSH:	0B1833C660957AEFC7836BBA06607FF008FF8BED24739066A691D4C1B2608553D6DD83
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10b000	0x429a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x90000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x10b000	0x429a8	0x42a00	ddbca325f028999692752b604176d609	False	0.3393857000469043	data	5.962191102721718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ