Windows Analysis Report
SecuriteInfo.com.FileRepMalware.20494.7181.exe

Overview

General Information

Sample name: SecuriteInfo.com.FileRepMalware.20494.7181.exe
Analysis ID: 1416942
MD5: af9764b5224f18db51d592d641caaf28
SHA1: e65b9a26d541fb15f265be8caed159e365a3f6ae
SHA256: 95c7b62982bdcde9fe8cc12839a414a1aa2171103a133454e9de2e406f3a3012
Tags: exe
Infos:

Detection

Xmrig
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Xmrig cryptocurrency miner
Detected Stratum mining protocol
Drops PE files to the startup folder
Found direct / indirect Syscall (likely to bypass EDR)
Found strings related to Crypto-Mining
Hides threads from debuggers
Machine Learning detection for dropped file
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
xmrig According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\_MEI42562\Microsoft Edge.exe Avira: detection malicious, Label: HEUR/AGEN.1324769
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\_MEI42562\Microsoft Edge.exe ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Temp\_MEI42562\Microsoft Edge.exe Virustotal: Detection: 57% Perma Link
Source: C:\Users\user\AppData\Local\Temp\_MEI42562\Runtime Broker.exe ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\_MEI42562\Runtime Broker.exe Virustotal: Detection: 53% Perma Link
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe ReversingLabs: Detection: 39%
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Virustotal: Detection: 54% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\_MEI42562\Runtime Broker.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\_MEI42562\Microsoft Edge.exe Joe Sandbox ML: detected

Bitcoin Miner
barindex
Yara detected Xmrig cryptocurrency miner
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2592398201.0000024D4EB4D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2591628032.0000021D2DA25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2592396227.0000021D2E371000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2323317181.00000145BBDCD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2322880889.00000145BB7F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2592396227.0000021D2E34D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2590937562.0000024D4CA75000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4764232973.000001859C368000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4762982805.000001859BEA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2323996765.00007FF612933000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2323317181.00000145BBDF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2592398201.0000024D4EB6F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4763394405.000001859C0AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.4763394405.000001859C0D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Microsoft Edge.exe PID: 6972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Microsoft Edge.exe PID: 356, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Microsoft Edge.exe PID: 5612, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Microsoft Edge.exe PID: 2676, type: MEMORYSTR
Detected Stratum mining protocol
Source: global traffic TCP traffic: 192.168.2.6:49716 -> 104.243.33.118:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"82taq2flvrsvsl9v9djldkvkimffniud1jaqjcu598weeb9xewn8rhag7uahxhd95uunrscehkqmqh487mcrnq8bnavon9d","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.
Source: global traffic TCP traffic: 192.168.2.6:49718 -> 104.243.33.118:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"82taq2flvrsvsl9v9djldkvkimffniud1jaqjcu598weeb9xewn8rhag7uahxhd95uunrscehkqmqh487mcrnq8bnavon9d","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.
Source: global traffic TCP traffic: 192.168.2.6:49722 -> 104.243.43.115:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"82taq2flvrsvsl9v9djldkvkimffniud1jaqjcu598weeb9xewn8rhag7uahxhd95uunrscehkqmqh487mcrnq8bnavon9d","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.
Source: global traffic TCP traffic: 192.168.2.6:49726 -> 199.247.27.41:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"13f1b8e03c22ff3cf3fc7edbeda44070ded304342c85a775ff9986886d0c4609","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"],"diff":65217,"height":3114822,"seed_hash":"1f3c89329b35b30bc9e1f8854f490150ea140f4edc32a365d1be8bdc49234482"}}.
Source: global traffic TCP traffic: 192.168.2.6:49732 -> 178.128.242.134:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"13f1b8e03c22ff3cf3fc7edbeda44070ded304342c85a775ff9986886d0c4609","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"],"diff":65217,"height":3114822,"seed_hash":"1f3c89329b35b30bc9e1f8854f490150ea140f4edc32a365d1be8bdc49234482"}}.
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 178.128.242.134:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"13f1b8e03c22ff3cf3fc7edbeda44070ded304342c85a775ff9986886d0c4609","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"],"diff":50000,"height":3114822,"seed_hash":"1f3c89329b35b30bc9e1f8854f490150ea140f4edc32a365d1be8bdc49234482"}}.
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 178.128.242.134:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"13f1b8e03c22ff3cf3fc7edbeda44070ded304342c85a775ff9986886d0c4609","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"],"diff":50000,"height":3114823,"seed_hash":"1f3c89329b35b30bc9e1f8854f490150ea140f4edc32a365d1be8bdc49234482"}}.
Source: global traffic TCP traffic: 192.168.2.6:49747 -> 178.128.242.134:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"13f1b8e03c22ff3cf3fc7edbeda44070ded304342c85a775ff9986886d0c4609","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"],"diff":50000,"height":3114823,"seed_hash":"1f3c89329b35b30bc9e1f8854f490150ea140f4edc32a365d1be8bdc49234482"}}.
Source: global traffic TCP traffic: 192.168.2.6:49752 -> 199.247.27.41:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"13f1b8e03c22ff3cf3fc7edbeda44070ded304342c85a775ff9986886d0c4609","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"],"diff":50000,"height":3114823,"seed_hash":"1f3c89329b35b30bc9e1f8854f490150ea140f4edc32a365d1be8bdc49234482"}}.
Source: global traffic TCP traffic: 192.168.2.6:49755 -> 104.243.43.115:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"82taq2flvrsvsl9v9djldkvkimffniud1jaqjcu598weeb9xewn8rhag7uahxhd95uunrscehkqmqh487mcrnq8bnavon9d","pass":"x","agent":"xmrig/6.21.1 (windows nt 10.0; win64; x64) libuv/1.44.2 gcc/11.2.0","algo":["cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.
Found strings related to Crypto-Mining
Source: Microsoft Edge.exe String found in binary or memory: stratum+ssl://
Source: Microsoft Edge.exe String found in binary or memory: cryptonight_v8
Source: Microsoft Edge.exe String found in binary or memory: stratum+tcp://
Source: Microsoft Edge.exe String found in binary or memory: -o, --url=URL URL of mining server
Source: Microsoft Edge.exe String found in binary or memory: Usage: xmrig [OPTIONS] Network:
Source: Microsoft Edge.exe String found in binary or memory: XMRig 6.21.1 built on Feb 25 2024 with GCC
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: \Projects\ConsoleApp1\obj\Debug\RuntimeBroker.pdb source: Runtime Broker.exe, 00000008.00000002.4765666112.00007FF66D802000.00000020.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765581162.00007FF66D802000.00000020.00000001.01000000.00000009.sdmp
Source: Binary string: ucrtbase.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321747885.00007FFD94871000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2322033281.00007FFDA416D000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2322131790.00007FFDA4341000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2322131790.00007FFDA4341000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321893983.00007FFDA377C000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbNN source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321893983.00007FFDA377C000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: ucrtbase.pdbUGP source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321747885.00007FFD94871000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: D:\_w\1\b\bin\amd64\python311.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2320065963.00007FFD94103000.00000002.00000001.01000000.00000005.sdmp, python311.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\Roaming\Microsoft\Windows\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\Roaming\ Jump to behavior

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2047928 ET TROJAN CoinMiner Domain in DNS Lookup (pool .supportxmr .com) 192.168.2.6:59815 -> 1.1.1.1:53
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49716 -> 104.243.33.118:3333
Source: global traffic TCP traffic: 192.168.2.6:49722 -> 104.243.43.115:3333
Source: global traffic TCP traffic: 192.168.2.6:49726 -> 199.247.27.41:3333
Source: global traffic TCP traffic: 192.168.2.6:49732 -> 178.128.242.134:3333
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RELIABLESITEUS RELIABLESITEUS
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown DNS traffic detected: queries for: pool.supportxmr.com
Source: python311.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: python311.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: python311.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: python311.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: python311.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: python311.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: python311.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: python311.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: python311.dll.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: python311.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: python311.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: python311.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: python311.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: http://s.symcd.com06
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: python311.dll.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: https://d.symcb.com/rpa0
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: https://d.symcb.com/rpa0.
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: https://enigmaprotector.com/taggant/spv.crl0
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, Runtime Broker.exe.0.dr String found in binary or memory: https://enigmaprotector.com/taggant/user.crl0
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2310197570.00000224C8EF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2312146004.00000224C9993000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2316416721.00000224C9994000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2309755070.00000224C9992000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2313588873.00000224C8E91000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2310994904.00000224C8E85000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2313470984.00000224C8E89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2315267276.00000224C8E92000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2307784520.00000224C8EBD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2307013330.00000224C997A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2311135451.00000224C8E87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2311661812.00000224C8EF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2315941951.00000224C90A8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2311135451.00000224C8E87000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2312146004.00000224C9993000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2316416721.00000224C9994000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2309755070.00000224C9992000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2313588873.00000224C8E91000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2310994904.00000224C8E85000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2313470984.00000224C8E89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2315267276.00000224C8E92000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2307013330.00000224C997A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2311135451.00000224C8E87000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2310197570.00000224C8EF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2312146004.00000224C9993000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2316416721.00000224C9994000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2309755070.00000224C9992000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2313588873.00000224C8E91000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2310994904.00000224C8E85000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2313470984.00000224C8E89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2315267276.00000224C8E92000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2307784520.00000224C8EBD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2307013330.00000224C997A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2311135451.00000224C8E87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000003.2311661812.00000224C8EF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2320065963.00007FFD94103000.00000002.00000001.01000000.00000005.sdmp, python311.dll.0.dr String found in binary or memory: https://peps.python.org/pep-0263/
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2315941951.00000224C9020000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2320329702.00007FFD94198000.00000004.00000001.01000000.00000005.sdmp, python311.dll.0.dr String found in binary or memory: https://www.python.org/psf/license/
Source: Microsoft Edge.exe, 00000007.00000002.2323996765.00007FF612933000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://xmrig.com/benchmark/%s
Source: Microsoft Edge.exe, Microsoft Edge.exe, 00000007.00000002.2323996765.00007FF612933000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Microsoft Edge.exe, Microsoft Edge.exe, 00000007.00000002.2323996765.00007FF612933000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://xmrig.com/wizard
Source: Microsoft Edge.exe, 00000007.00000002.2323996765.00007FF612933000.00000002.00000001.01000000.0000000A.sdmp String found in binary or memory: https://xmrig.com/wizard%s
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000007.00000002.2323996765.00007FF612933000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000007.00000002.2323545081.00007FF612331000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: Process Memory Space: Microsoft Edge.exe PID: 6972, type: MEMORYSTR Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
PE file has nameless sections
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Runtime Broker.exe.0.dr Static PE information: section name:
Source: Runtime Broker.exe.0.dr Static PE information: section name:
Source: Runtime Broker.exe.0.dr Static PE information: section name:
Source: Runtime Broker.exe.0.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Code function: 0_2_00007DF433E10AAB 0_2_00007DF433E10AAB
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\_MEI42562\VCRUNTIME140.dll 76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
PE file contains executable resources (Code or Archives)
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file contains more sections than normal
Source: Microsoft Edge.exe.0.dr Static PE information: Number of sections : 14 > 10
PE file does not import any functions
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2322174511.00007FFDA4347000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.FileRepMalware.20494.7181.exe
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321974373.00007FFDA3785000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs SecuriteInfo.com.FileRepMalware.20494.7181.exe
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321803693.00007FFD948AC000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs SecuriteInfo.com.FileRepMalware.20494.7181.exe
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2322076469.00007FFDA4172000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs SecuriteInfo.com.FileRepMalware.20494.7181.exe
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321605018.00007FFD94337000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamepython311.dll. vs SecuriteInfo.com.FileRepMalware.20494.7181.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Section loaded: python3.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Section loaded: rsaenh.dll Jump to behavior
Yara signature match
Source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000007.00000002.2323996765.00007FF612933000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000007.00000002.2323545081.00007FF612331000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: Process Memory Space: Microsoft Edge.exe PID: 6972, type: MEMORYSTR Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: Section: ZLIB complexity 0.9950942095588236
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: Section: ZLIB complexity 0.9899968327702703
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: Section: ZLIB complexity 0.9986915958737864
Source: Microsoft Edge.exe.0.dr Static PE information: Section: ZLIB complexity 0.9968449519230769
Source: Microsoft Edge.exe.0.dr Static PE information: Section: ZLIB complexity 0.999841588144084
Source: Microsoft Edge.exe.0.dr Static PE information: Section: ZLIB complexity 0.9996314858490566
Source: classification engine Classification label: mal100.adwa.evad.mine.winEXE@22/56@3/4
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5276:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5260:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1592:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe ReversingLabs: Detection: 39%
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Virustotal: Detection: 54%
Source: Microsoft Edge.exe String found in binary or memory: -h, --help display this help and exit
Source: Microsoft Edge.exe String found in binary or memory: -h, --help display this help and exit
Source: Microsoft Edge.exe String found in binary or memory: t_prefetch_vgpr_index=-vgpr_id; jit_vmcnt=(vmcnt<s_waitcnt_value)?vmcnt:-1; if(vmcnt<s_waitcnt_value) s_waitcnt_value=vmcnt; done=true; } p=jit_emit_instruction(p,last_branch_target,jit_inst,jit_prefetch_vgpr_index,jit_vmcnt,batch_size); if(p-start_p>size_limi
Source: Microsoft Edge.exe String found in binary or memory: --help
Source: Microsoft Edge.exe String found in binary or memory: --help
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe""
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe""
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe"" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe"" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static file information: File size 20270420 > 1048576
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: Raw size of is bigger than: 0x100000 < 0x2c5c00
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: \Projects\ConsoleApp1\obj\Debug\RuntimeBroker.pdb source: Runtime Broker.exe, 00000008.00000002.4765666112.00007FF66D802000.00000020.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765581162.00007FF66D802000.00000020.00000001.01000000.00000009.sdmp
Source: Binary string: ucrtbase.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321747885.00007FFD94871000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2322033281.00007FFDA416D000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2322131790.00007FFDA4341000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2322131790.00007FFDA4341000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321893983.00007FFDA377C000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbNN source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321893983.00007FFDA377C000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: ucrtbase.pdbUGP source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2321747885.00007FFD94871000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: D:\_w\1\b\bin\amd64\python311.pdb source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2320065963.00007FFD94103000.00000002.00000001.01000000.00000005.sdmp, python311.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Unpacked PE file: 0.2.SecuriteInfo.com.FileRepMalware.20494.7181.exe.7ff794250000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:EW;Unknown_Section6:EW;.rsrc:EW;Unknown_Section8:EW;Unknown_Section9:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:R;Unknown_Section6:R;.rsrc:EW;Unknown_Section8:EW;Unknown_Section9:EW;
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Unpacked PE file: 2.2.SecuriteInfo.com.FileRepMalware.20494.7181.exe.7ff794250000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:EW;Unknown_Section6:EW;.rsrc:EW;Unknown_Section8:EW;Unknown_Section9:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:R;Unknown_Section6:R;.rsrc:EW;Unknown_Section8:EW;Unknown_Section9:EW;
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Unpacked PE file: 7.2.Microsoft Edge.exe.7ff612330000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:W;Unknown_Section6:EW;Unknown_Section7:EW;Unknown_Section8:EW;Unknown_Section9:EW;Unknown_Section10:EW;.rsrc:EW;Unknown_Section12:EW;Unknown_Section13:EW; vs Unknown_Section0:ER;Unknown_Section1:W;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:W;Unknown_Section6:W;Unknown_Section7:W;Unknown_Section8:W;Unknown_Section9:W;Unknown_Section10:R;.rsrc:EW;Unknown_Section12:EW;Unknown_Section13:EW;
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Unpacked PE file: 8.2.Runtime Broker.exe.7ff66d800000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;.rsrc:EW;Unknown_Section3:EW;Unknown_Section4:EW; vs Unknown_Section0:ER;Unknown_Section1:R;.rsrc:ER;Unknown_Section3:ER;Unknown_Section4:ER;
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Unpacked PE file: 15.2.Runtime Broker.exe.7ff66d800000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;.rsrc:EW;Unknown_Section3:EW;Unknown_Section4:EW; vs Unknown_Section0:ER;Unknown_Section1:R;.rsrc:ER;Unknown_Section3:ER;Unknown_Section4:ER;
Binary contains a suspicious time stamp
Source: Runtime Broker.exe.0.dr Static PE information: 0xC4AE2868 [Wed Jul 25 12:39:04 2074 UTC]
PE file contains an invalid checksum
Source: Microsoft Edge.exe.0.dr Static PE information: real checksum: 0x80e909 should be: 0x66fe39
Source: Runtime Broker.exe.0.dr Static PE information: real checksum: 0x0 should be: 0x2fc202
PE file contains sections with non-standard names
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name:
Source: libcrypto-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: python311.dll.0.dr Static PE information: section name: PyRuntim
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Microsoft Edge.exe.0.dr Static PE information: section name:
Source: Runtime Broker.exe.0.dr Static PE information: section name:
Source: Runtime Broker.exe.0.dr Static PE information: section name:
Source: Runtime Broker.exe.0.dr Static PE information: section name:
Source: Runtime Broker.exe.0.dr Static PE information: section name:
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name: entropy: 7.993690532935202
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name: entropy: 7.980897892360261
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name: entropy: 7.219186418605474
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name: entropy: 7.995879815906581
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe Static PE information: section name: entropy: 7.497746838564346
Source: Microsoft Edge.exe.0.dr Static PE information: section name: entropy: 7.9794434122834685
Source: Microsoft Edge.exe.0.dr Static PE information: section name: entropy: 7.999556299657626
Source: Microsoft Edge.exe.0.dr Static PE information: section name: entropy: 7.9961487575621515
Source: Microsoft Edge.exe.0.dr Static PE information: section name: entropy: 7.876010389655013
Source: Runtime Broker.exe.0.dr Static PE information: section name: entropy: 7.499159924967502
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\Runtime Broker.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe (copy) Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\python311.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\Microsoft Edge.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe (copy) Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file

Boot Survival
barindex
Drops PE files to the startup folder
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe (copy) Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe System information queried: FirmwareTableInformation
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Memory allocated: 22134AD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Memory allocated: 2214D100000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Memory allocated: 29C2D0B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Memory allocated: 29C45D70000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Window / User API: threadDelayed 549 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Window / User API: threadDelayed 7120 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Window / User API: threadDelayed 1808 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Window / User API: threadDelayed 945 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Window / User API: threadDelayed 8455 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Window / User API: threadDelayed 727 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Window / User API: threadDelayed 604
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Window / User API: threadDelayed 9283
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\python311.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42562\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe TID: 4924 Thread sleep count: 549 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe TID: 3432 Thread sleep count: 48 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 5100 Thread sleep count: 49 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 5100 Thread sleep time: -49000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 2708 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 2708 Thread sleep time: -43000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 5908 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 2820 Thread sleep count: 7120 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 2820 Thread sleep count: 1808 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe TID: 6084 Thread sleep count: 945 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 5248 Thread sleep count: 31 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 5248 Thread sleep time: -31000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 3352 Thread sleep count: 33 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 3352 Thread sleep time: -33000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 6116 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 6052 Thread sleep count: 8455 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe TID: 6052 Thread sleep count: 727 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe TID: 5464 Thread sleep count: 604 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe TID: 2588 Thread sleep count: 9283 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\Roaming\Microsoft\Windows\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe File opened: c:\Users\user\AppData\Roaming\ Jump to behavior
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: Microsoft Edge.exe, 0000000B.00000002.2592009488.0000021D2DF05000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: vmware
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: Microsoft Edge.exe, 00000009.00000002.2592007225.0000024D4EA45000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWpx
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Hyper-V (guest)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: Microsoft Edge.exe, 00000007.00000002.2323158465.00000145BBCC5000.00000004.00000020.00020000.00000000.sdmp, Microsoft Edge.exe, 00000009.00000002.2592007225.0000024D4EA45000.00000004.00000020.00020000.00000000.sdmp, Microsoft Edge.exe, 0000000B.00000002.2592009488.0000021D2DF05000.00000004.00000020.00020000.00000000.sdmp, Microsoft Edge.exe, 00000010.00000002.4764232973.000001859C335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: VBoxService.exe
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Virtual MachinesbiedllVBoxService.exe
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: VMWare
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000000.00000002.2330666134.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.FileRepMalware.20494.7181.exe, 00000002.00000002.2317765733.00007FF7942B4000.00000040.00000001.01000000.00000003.sdmp, Microsoft Edge.exe, 00000007.00000002.2324334152.00007FF612E8E000.00000040.00000001.01000000.0000000A.sdmp, Runtime Broker.exe, 00000008.00000002.4765715991.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp, Runtime Broker.exe, 0000000F.00000002.4765630356.00007FF66D808000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Thread information set: HideFromDebugger
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtOpenSection: Indirect: 0x7FF612F1BB35 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtOpenKey: Indirect: 0x7FF612F1AF85 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtClose: Indirect: 0x7FF612F1C0B6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtSetInformationThread: Indirect: 0x7FF612ECFADD Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtQueryAttributesFile: Indirect: 0x7FF74780C41F Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtSetInformationThread: Indirect: 0x7FF7477BFADD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtResumeThread: Indirect: 0x7FF74780A81F
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtProtectVirtualMemory: Indirect: 0x7FF74780DA4B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe NtProtectVirtualMemory: Indirect: 0x7FF66D897A4B Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtUnmapViewOfSection: Indirect: 0x7FF74780BE8F Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe NtProtectVirtualMemory: Indirect: 0x7FF66E29CE2E Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtUnmapViewOfSection: Indirect: 0x7FF612F1BE8F Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtProtectVirtualMemory: Indirect: 0x7FF61393CFB8 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtProtectVirtualMemory: Indirect: 0x7FF74822CFB8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe NtSetInformationThread: Indirect: 0x7FF66D849ADD Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtProtectVirtualMemory: Indirect: 0x7FF612F1DA4B Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtResumeThread: Indirect: 0x7FF612F1A81F Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtQueryAttributesFile: Indirect: 0x7FF612F1C41F Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtClose: Indirect: 0x7FF74780C0B6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtOpenSection: Indirect: 0x7FF74780BB35 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe NtOpenKey: Indirect: 0x7FF74780AF85 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge" Jump to behavior
Source: conhost.exe, 00000011.00000002.4762347576.0000023ED2D61000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: IProgram Manager
Source: conhost.exe, 00000011.00000002.4762347576.0000023ED2D61000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: conhost.exe, 00000011.00000002.4762347576.0000023ED2D61000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: conhost.exe, 00000011.00000002.4762347576.0000023ED2D61000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\ucrtbase.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42562 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Code function: 2_2_00007FFD93F14ABC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 2_2_00007FFD93F14ABC
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.20494.7181.exe Code function: 0_2_00007DF433E11F00 GetUserNameA, 0_2_00007DF433E11F00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1416942 Sample: SecuriteInfo.com.FileRepMal... Startdate: 28/03/2024 Architecture: WINDOWS Score: 100 61 donate.v2.xmrig.com 2->61 63 donate.ssl.xmrig.com 2->63 65 2 other IPs or domains 2->65 79 Snort IDS alert for network traffic 2->79 81 Malicious sample detected (through community Yara rule) 2->81 83 Antivirus detection for dropped file 2->83 85 8 other signatures 2->85 11 SecuriteInfo.com.FileRepMalware.20494.7181.exe 55 2->11         started        15 Runtime Broker.exe 2->15         started        17 Microsoft Edge.exe 2 2->17         started        signatures3 process4 file5 53 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 11->53 dropped 55 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 11->55 dropped 57 C:\Users\user\AppData\Local\...\python311.dll, PE32+ 11->57 dropped 59 50 other files (48 malicious) 11->59 dropped 95 Detected unpacking (changes PE section rights) 11->95 97 Drops PE files to the startup folder 11->97 99 Hides threads from debuggers 11->99 19 SecuriteInfo.com.FileRepMalware.20494.7181.exe 11->19         started        101 Found direct / indirect Syscall (likely to bypass EDR) 15->101 23 Microsoft Edge.exe 2 15->23         started        103 Query firmware table information (likely to detect VMs) 17->103 26 conhost.exe 17->26         started        signatures6 process7 dnsIp8 49 C:\Users\user\...\Runtime Broker.exe (copy), PE32+ 19->49 dropped 51 C:\Users\user\...\Microsoft Edge.exe (copy), PE32+ 19->51 dropped 87 Hides threads from debuggers 19->87 28 cmd.exe 1 19->28         started        30 cmd.exe 1 19->30         started        67 104.243.43.115, 3333, 49722, 49755 RELIABLESITEUS United States 23->67 69 donate.v2.xmrig.com 178.128.242.134, 3333, 443, 49724 DIGITALOCEAN-ASNUS Netherlands 23->69 71 199.247.27.41, 3333, 443, 49725 AS-CHOOPAUS European Union 23->71 89 Query firmware table information (likely to detect VMs) 23->89 91 Found direct / indirect Syscall (likely to bypass EDR) 23->91 32 conhost.exe 23->32         started        file9 93 Detected Stratum mining protocol 71->93 signatures10 process11 process12 34 Runtime Broker.exe 28->34         started        37 conhost.exe 28->37         started        39 Microsoft Edge.exe 2 30->39         started        41 conhost.exe 30->41         started        signatures13 75 Hides threads from debuggers 34->75 43 Microsoft Edge.exe 2 34->43         started        77 Query firmware table information (likely to detect VMs) 39->77 process14 dnsIp15 73 pool-nyc.supportxmr.com 104.243.33.118, 3333, 49716, 49718 RELIABLESITEUS United States 43->73 105 Query firmware table information (likely to detect VMs) 43->105 107 Hides threads from debuggers 43->107 47 conhost.exe 43->47         started        signatures16 109 Detected Stratum mining protocol 73->109 process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.243.43.115
 unknown United States
23470 RELIABLESITEUS true
178.128.242.134
 donate.ssl.xmrig.com Netherlands
14061 DIGITALOCEAN-ASNUS true
104.243.33.118
 pool-nyc.supportxmr.com United States
23470 RELIABLESITEUS false
199.247.27.41
 unknown European Union
20473 AS-CHOOPAUS true

Contacted Domains

Name IP Active
donate.ssl.xmrig.com 178.128.242.134 true
donate.v2.xmrig.com 178.128.242.134 true
pool-nyc.supportxmr.com 104.243.33.118 true
pool.supportxmr.com unknown unknown