Windows Analysis Report
Update.exe

Overview

General Information

Sample name: Update.exe
Analysis ID: 1531095
MD5: ae0de63d46ce36491a606bd70341a63b
SHA1: 1e9d6893ec493e7a0ac565011d3aa31b0de29303
SHA256: 83cb5e8b7455fcb3b6c2d45269b08b3ae003dfed4ce8ca942cd007c1ebf17cf2
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Deletes shadow drive data (may be related to ransomware)
May disable shadow drive data (uses vssadmin)
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Uses bcdedit to modify the Windows boot settings
AV process strings found (often used to terminate AV products)
Creates a process in suspended mode (likely to inject code)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Update.exe ReversingLabs: Detection: 25%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 97.9% probability
Source: Update.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbq7 source: Update.exe, 00000000.00000003.2368911410.0000029EF94D0000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2259318701.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2241952573.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208863131.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177042257.0000029EF45C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2282198779.0000029EF46EA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325877020.0000029EF46EB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292978197.0000029EF46EB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281758917.0000029EF46E5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260172057.0000029EF46E2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281409885.0000029EF46E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: Update.exe, 00000000.00000002.2439521824.0000029EF670C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2454154214.0000029EF6ECF000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2447047612.0000029EF6A21000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2559198843.0000029EFA42A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2439521824.0000029EF671A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2540724013.0000029EF9C3B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2502618215.0000029EF8711000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2486895063.0000029EF7DFE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2515300137.0000029EF8D92000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2509877155.0000029EF8AA6000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2525815256.0000029EF921B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2470455858.0000029EF75FB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2580342670.0000029EFB115000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb% source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorIch source: Update.exe, 00000000.00000003.2259000358.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176883250.0000029EF4465000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314024265.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2300896813.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2207673148.0000029EF4486000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2259107258.0000029EF466A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2239064998.0000029EF4653000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292494568.0000029EF4672000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2430986257.0000029EF4672000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177130993.0000029EF4619000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2259107258.0000029EF466A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2239064998.0000029EF4653000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292494568.0000029EF4672000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2430986257.0000029EF4672000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177130993.0000029EF4619000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2336337948.0000029EF94F1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2259000358.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176883250.0000029EF4465000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314024265.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2300896813.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2207673148.0000029EF4486000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2368911410.0000029EF94D0000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorP source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2336337948.0000029EF94F1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2358051004.0000029EF9554000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2282198779.0000029EF46EA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325877020.0000029EF46EB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292978197.0000029EF46EB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281758917.0000029EF46E5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260172057.0000029EF46E2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281409885.0000029EF46E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2358051004.0000029EF9554000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2301325677.0000029EF942D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326345787.0000029EF9451000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325947588.0000029EF943C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292681513.0000029EF93B1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301105754.0000029EF9408000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293087773.0000029EF9401000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346358325.0000029EF9454000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorL source: Update.exe, 00000000.00000003.2176991170.0000029EF442D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2207799320.0000029EF4440000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177256894.0000029EF443F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2061253597.0000029EF441F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177101870.0000029EF4437000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2176991170.0000029EF442D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2061253597.0000029EF441F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2239907077.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259431615.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176938293.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208606337.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbx source: Update.exe, 00000000.00000002.2439521824.0000029EF670C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2454154214.0000029EF6ECF000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2447047612.0000029EF6A21000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2238488872.0000029EF43DB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259064191.0000029EF4404000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb source: Update.exe, 00000000.00000002.2454154214.0000029EF6ECF000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2447047612.0000029EF6A21000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2559198843.0000029EFA42A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2509877155.0000029EF8AA3000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2439521824.0000029EF671A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2540724013.0000029EF9C3B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2502618215.0000029EF8711000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2486895063.0000029EF7DFE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2515300137.0000029EF8D92000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2509877155.0000029EF8AA6000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2525815256.0000029EF921B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2470455858.0000029EF75FB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2580342670.0000029EFB115000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\pc\Desktop\Codes\Ransom\x64\Release\Update.pdb00%GCTL source: Update.exe
Source: Binary string: C:\Users\pc\Desktop\Codes\Ransom\x64\Release\Update.pdb source: Update.exe
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb& source: Update.exe, 00000000.00000003.2259318701.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2241952573.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208863131.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177042257.0000029EF45C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2238488872.0000029EF43DB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259064191.0000029EF4404000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb# source: Update.exe, 00000000.00000003.2336337948.0000029EF94F1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2368911410.0000029EF9510000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2383783152.0000029EF9510000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301226296.0000029EF47D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301437468.0000029EF47E9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314278228.0000029EF47F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorI source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbQ source: Update.exe, 00000000.00000003.2336447958.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2411337319.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379725281.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326294365.0000029EF95A5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2392291814.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2385440927.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2336403888.0000029EF95C9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2314107711.0000029EF4398000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208102318.0000029EF436D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208190121.0000029EF4381000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2238278448.0000029EF4390000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2336447958.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2411337319.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379725281.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326294365.0000029EF95A5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2392291814.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2385440927.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2336403888.0000029EF95C9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2314107711.0000029EF4398000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208102318.0000029EF436D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208190121.0000029EF4381000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2238278448.0000029EF4390000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2239907077.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259431615.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176938293.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208606337.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error&,g source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301226296.0000029EF47D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301437468.0000029EF47E9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314278228.0000029EF47F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbN source: Update.exe, 00000000.00000003.2301325677.0000029EF942D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326345787.0000029EF9451000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325947588.0000029EF943C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292681513.0000029EF93B1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301105754.0000029EF9408000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293087773.0000029EF9401000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346358325.0000029EF9454000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2176991170.0000029EF442D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2207799320.0000029EF4440000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177256894.0000029EF443F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2061253597.0000029EF441F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177101870.0000029EF4437000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2301325677.0000029EF942D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326345787.0000029EF9451000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325947588.0000029EF943C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292681513.0000029EF93B1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301105754.0000029EF9408000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293087773.0000029EF9401000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346358325.0000029EF9454000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error5 source: Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb_- source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301226296.0000029EF47D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301437468.0000029EF47E9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314278228.0000029EF47F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorQ source: Update.exe, 00000000.00000003.2239907077.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2412993217.0000029EF965C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369854218.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259431615.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379599443.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176938293.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2389367848.0000029EF9659000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208606337.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301226296.0000029EF47C8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2281409885.0000029EF4715000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292653379.0000029EF471B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281554818.0000029EF4715000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2281409885.0000029EF4715000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292653379.0000029EF471B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281554818.0000029EF4715000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2239907077.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2412993217.0000029EF965C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369854218.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259431615.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379599443.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176938293.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2389367848.0000029EF9659000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208606337.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb' source: Update.exe, 00000000.00000003.2292681513.0000029EF93B1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301105754.0000029EF9408000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293087773.0000029EF9401000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\ Jump to behavior

Spam, unwanted Advertisements and Ransom Demands
barindex
Deletes shadow drive data (may be related to ransomware)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: Update.exe, 00000000.00000002.2433913171.0000029EF410C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet Jump to behavior
Source: vssadmin.exe, 00000005.00000002.2041849473.00000131AC605000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vssadmin.exeDeleteShadows/All/Quietb"
Source: vssadmin.exe, 00000005.00000002.2041881996.00000131AC610000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet vssadmin.exe Delete Shadows /All /Quiet Winsta0\DefaultQ
Source: vssadmin.exe, 00000005.00000002.2041881996.00000131AC610000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
May disable shadow drive data (uses vssadmin)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet Jump to behavior
Source: classification engine Classification label: mal68.rans.winEXE@13/1383@0/1
Source: C:\Users\user\Desktop\Update.exe File created: C:\Users\user\Desktop\Important.txt Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\On3_S1d3d_hard
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5008:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3424:120:WilError_03
Source: Update.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Update.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Update.exe ReversingLabs: Detection: 25%
Source: unknown Process created: C:\Users\user\Desktop\Update.exe "C:\Users\user\Desktop\Update.exe"
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe" Important.txt
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe" Important.txt Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: ws2_32 .dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\vssadmin.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\vssadmin.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\vssadmin.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\vssadmin.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\vssadmin.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\vssadmin.exe Section loaded: vss_ps.dll Jump to behavior
Source: C:\Windows\System32\bcdedit.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\bcdedit.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: mrmcorer.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: efswrt.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\notepad.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Update.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Update.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Update.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbq7 source: Update.exe, 00000000.00000003.2368911410.0000029EF94D0000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2259318701.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2241952573.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208863131.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177042257.0000029EF45C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2282198779.0000029EF46EA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325877020.0000029EF46EB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292978197.0000029EF46EB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281758917.0000029EF46E5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260172057.0000029EF46E2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281409885.0000029EF46E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: Update.exe, 00000000.00000002.2439521824.0000029EF670C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2454154214.0000029EF6ECF000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2447047612.0000029EF6A21000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2559198843.0000029EFA42A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2439521824.0000029EF671A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2540724013.0000029EF9C3B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2502618215.0000029EF8711000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2486895063.0000029EF7DFE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2515300137.0000029EF8D92000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2509877155.0000029EF8AA6000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2525815256.0000029EF921B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2470455858.0000029EF75FB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2580342670.0000029EFB115000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb% source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorIch source: Update.exe, 00000000.00000003.2259000358.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176883250.0000029EF4465000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314024265.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2300896813.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2207673148.0000029EF4486000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2259107258.0000029EF466A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2239064998.0000029EF4653000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292494568.0000029EF4672000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2430986257.0000029EF4672000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177130993.0000029EF4619000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2259107258.0000029EF466A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2239064998.0000029EF4653000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292494568.0000029EF4672000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2430986257.0000029EF4672000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177130993.0000029EF4619000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2336337948.0000029EF94F1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2259000358.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176883250.0000029EF4465000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314024265.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2300896813.0000029EF4496000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2207673148.0000029EF4486000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2368911410.0000029EF94D0000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorP source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2336337948.0000029EF94F1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2358051004.0000029EF9554000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2282198779.0000029EF46EA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325877020.0000029EF46EB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292978197.0000029EF46EB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281758917.0000029EF46E5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260172057.0000029EF46E2000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281409885.0000029EF46E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2358051004.0000029EF9554000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2301325677.0000029EF942D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326345787.0000029EF9451000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325947588.0000029EF943C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292681513.0000029EF93B1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301105754.0000029EF9408000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293087773.0000029EF9401000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346358325.0000029EF9454000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorL source: Update.exe, 00000000.00000003.2176991170.0000029EF442D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2207799320.0000029EF4440000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177256894.0000029EF443F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2061253597.0000029EF441F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177101870.0000029EF4437000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2176991170.0000029EF442D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2061253597.0000029EF441F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2239907077.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259431615.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176938293.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208606337.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdbx source: Update.exe, 00000000.00000002.2439521824.0000029EF670C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2454154214.0000029EF6ECF000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2447047612.0000029EF6A21000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2238488872.0000029EF43DB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259064191.0000029EF4404000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb source: Update.exe, 00000000.00000002.2454154214.0000029EF6ECF000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2447047612.0000029EF6A21000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2559198843.0000029EFA42A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2509877155.0000029EF8AA3000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2439521824.0000029EF671A000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2540724013.0000029EF9C3B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2502618215.0000029EF8711000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2486895063.0000029EF7DFE000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2515300137.0000029EF8D92000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2509877155.0000029EF8AA6000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2525815256.0000029EF921B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2470455858.0000029EF75FB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000002.2580342670.0000029EFB115000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\pc\Desktop\Codes\Ransom\x64\Release\Update.pdb00%GCTL source: Update.exe
Source: Binary string: C:\Users\pc\Desktop\Codes\Ransom\x64\Release\Update.pdb source: Update.exe
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb& source: Update.exe, 00000000.00000003.2259318701.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2241952573.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208863131.0000029EF45CC000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177042257.0000029EF45C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2238488872.0000029EF43DB000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259064191.0000029EF4404000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb# source: Update.exe, 00000000.00000003.2336337948.0000029EF94F1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2368911410.0000029EF9510000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2383783152.0000029EF9510000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301226296.0000029EF47D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301437468.0000029EF47E9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314278228.0000029EF47F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorI source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbQ source: Update.exe, 00000000.00000003.2336447958.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2411337319.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379725281.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326294365.0000029EF95A5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2392291814.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2385440927.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2336403888.0000029EF95C9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: Update.exe, 00000000.00000003.2314107711.0000029EF4398000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208102318.0000029EF436D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208190121.0000029EF4381000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2238278448.0000029EF4390000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2336447958.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2411337319.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379725281.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326294365.0000029EF95A5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2392291814.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2385440927.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2336403888.0000029EF95C9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2314107711.0000029EF4398000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208102318.0000029EF436D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208190121.0000029EF4381000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2238278448.0000029EF4390000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2239907077.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259431615.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176938293.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208606337.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error&,g source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301226296.0000029EF47D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301437468.0000029EF47E9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314278228.0000029EF47F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbN source: Update.exe, 00000000.00000003.2301325677.0000029EF942D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326345787.0000029EF9451000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325947588.0000029EF943C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292681513.0000029EF93B1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301105754.0000029EF9408000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293087773.0000029EF9401000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346358325.0000029EF9454000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2176991170.0000029EF442D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2207799320.0000029EF4440000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177256894.0000029EF443F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2061253597.0000029EF441F000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2177101870.0000029EF4437000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: Update.exe, 00000000.00000003.2301325677.0000029EF942D000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326345787.0000029EF9451000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2325947588.0000029EF943C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292681513.0000029EF93B1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301105754.0000029EF9408000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293087773.0000029EF9401000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346358325.0000029EF9454000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error5 source: Update.exe, 00000000.00000003.2176750981.0000029EF45E3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb_- source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293058856.0000029EF47CA000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301226296.0000029EF47D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301437468.0000029EF47E9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314278228.0000029EF47F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorQ source: Update.exe, 00000000.00000003.2239907077.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2412993217.0000029EF965C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369854218.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259431615.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379599443.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176938293.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2389367848.0000029EF9659000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208606337.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2292750137.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281310532.0000029EF474E000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301226296.0000029EF47C8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2282228187.0000029EF4796000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292300000.0000029EF4797000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: Update.exe, 00000000.00000003.2281409885.0000029EF4715000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292653379.0000029EF471B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281554818.0000029EF4715000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2281409885.0000029EF4715000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2292653379.0000029EF471B000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259212271.0000029EF46B5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259472878.0000029EF4700000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2260194640.0000029EF4712000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2281554818.0000029EF4715000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: Update.exe, 00000000.00000003.2239907077.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2412993217.0000029EF965C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369854218.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2259431615.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379599443.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2176938293.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2389367848.0000029EF9659000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2208606337.0000029EF9629000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb' source: Update.exe, 00000000.00000003.2292681513.0000029EF93B1000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2301105754.0000029EF9408000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2293087773.0000029EF9401000.00000004.00000020.00020000.00000000.sdmp
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Update.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior
barindex
Uses bcdedit to modify the Windows boot settings
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\conhost.exe Window / User API: threadDelayed 1264 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\ Jump to behavior
Source: C:\Users\user\Desktop\Update.exe File opened: C:\Users\user\AppData\Local\Adobe\ Jump to behavior
Source: Update.exe, 00000000.00000002.2449119517.0000029EF6BE8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: bcdedit.exe, 00000009.00000002.2044608472.0000027563588000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pEFI VMware Virtual SATA CDROM Drive (0.0)
Source: C:\Users\user\Desktop\Update.exe Process information queried: ProcessInformation Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures Jump to behavior
Source: C:\Users\user\Desktop\Update.exe Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe" Important.txt Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\Desktop\Important.txt VolumeInformation Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Update.exe, 00000000.00000003.2336447958.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2411337319.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379725281.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326294365.0000029EF95A5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2392291814.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2385440927.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2336403888.0000029EF95C9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\All Users\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: Update.exe, 00000000.00000003.2407792150.0000029EFA6F6000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2358164796.0000029EFA6D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346763038.0000029EFA699000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2431429909.0000029EFA6F6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\All Users\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: Update.exe, 00000000.00000003.2362947264.0000029EFA707000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2380790543.0000029EFA727000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2358164796.0000029EFA6D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2370738373.0000029EFA727000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346763038.0000029EFA699000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379766945.0000029EFA707000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369935101.0000029EFA707000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2429904660.0000029EFA728000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\All Users\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1531095 Sample: Update.exe Startdate: 10/10/2024 Architecture: WINDOWS Score: 68 38 Multi AV Scanner detection for submitted file 2->38 40 AI detected suspicious sample 2->40 42 Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities 2->42 7 Update.exe 3 2->7         started        process3 dnsIp4 36 192.168.1.104, 54452, 8000 unknown unknown 7->36 28 C:\Users\user\AppData\...\rule170137v0.xml, SVR2 7->28 dropped 30 C:\Users\user\AppData\...\rule68015v1.xml, VAX-order 7->30 dropped 32 C:\Users\user\AppData\...\rule68001v2.xml, amd 7->32 dropped 34 5 other files (none is malicious) 7->34 dropped 46 Deletes shadow drive data (may be related to ransomware) 7->46 48 Uses bcdedit to modify the Windows boot settings 7->48 12 cmd.exe 1 7->12         started        15 notepad.exe 5 7->15         started        17 conhost.exe 7->17         started        file5 signatures6 process7 signatures8 50 May disable shadow drive data (uses vssadmin) 12->50 52 Deletes shadow drive data (may be related to ransomware) 12->52 54 Uses bcdedit to modify the Windows boot settings 12->54 19 vssadmin.exe 1 12->19         started        22 bcdedit.exe 9 1 12->22         started        24 bcdedit.exe 8 1 12->24         started        26 conhost.exe 12->26         started        process9 signatures10 44 Deletes shadow drive data (may be related to ransomware) 19->44
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
192.168.1.104