Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe

Overview

General Information

Sample Name: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe
Analysis ID: 634670
MD5: 67a4759a7b2fcb1a7e5b368fc150b974
SHA1: 592934bd8f6606f80a890008008a621f7abda152
SHA256: 19762fa9a397bf711cb2aa16f78915d4beaf49e9b67ffccfa3e3b01e35c7289a
Infos:

Detection

AgentTesla, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected AgentTesla
Yara detected GuLoader
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to steal Mail credentials (via file / registry access)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Sample is not signed and drops a device driver
DLL side loading technique detected
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
C2 URLs / IPs found in malware configuration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Found evasive API chain checking for process token information
Creates driver files
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Spawns drivers
PE file contains more sections than normal
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Deletes files inside the Windows folder
Contains functionality to shutdown / reboot the system
PE file contains sections with non-standard names
Stores large binary data to the registry
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
AV process strings found (often used to terminate AV products)
PE file does not import any functions
Sample file is different than original file name gathered from version info
Enables security privileges
Contains functionality to enumerate device drivers
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates or modifies windows services
Queries disk information (often used to detect virtual machines)
Uses Microsoft's Enhanced Cryptographic Provider
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000001.00000002.18483403549.0000000002A10000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1c-6Y7E6EFCnEfeUqjiCzqb4bjj7oMV7b"}
Source: mpam-60574f34.exe.2156.16.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "apoio.cliente@asfaltolargo.ptApoioCliente2018!mail.asfaltolargo.ptamorimoffice6@gmail.com"}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Virustotal: Detection: 30% Perma Link
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe ReversingLabs: Detection: 22%
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_2061A178 CryptUnprotectData, 5_2_2061A178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_2061A790 CryptUnprotectData, 5_2_2061A790
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DC1C4 CreateDirectoryW,FreeLibrary,DecryptFileW,FreeLibrary,FreeLibrary, 7_2_00007FF6F44DC1C4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A1C1C4 CreateDirectoryW,FreeLibrary,DecryptFileW,FreeLibrary,FreeLibrary, 19_2_00007FF7D3A1C1C4
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dado Jump to behavior
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: ConfigSecurityPolicy.pdb source: MpSigStub.exe, 00000013.00000003.18750149036.000001F8CDE37000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAzSubmit.pdb source: MpSigStub.exe, 00000013.00000003.18751240013.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NisSrv.pdb source: NisSrv.exe.16.dr
Source: Binary string: MpRTP.pdb source: mpam-60574f34.exe, 00000010.00000003.18535264051.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754931951.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WdBoot.pdb source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAdlStub.pdb source: mpam-e428c3f6.exe, 00000003.00000000.18199651604.00007FF74E73F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: WdFilter.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAzSubmit.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18751240013.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpSenseComm.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18755428699.000001F8CDE4C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpClient.pdb source: MpSigStub.exe, 00000007.00000003.18393894759.000001DE0F544000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WdDevFlt.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpDetours.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18531267121.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18753195690.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18761615816.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp, MpDetours.dll0.16.dr
Source: Binary string: ProtectionManagement.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18544926204.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18758774396.000001F8CDE41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpSigStub.pdbGCTL source: MpSigStub.exe, 00000007.00000003.18401631614.000001DE0F547000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000007.00000000.18387090699.00007FF6F4507000.00000002.00000001.01000000.0000000A.sdmp, MpSigStub.exe, 00000007.00000002.18489828227.00007FF6F4507000.00000002.00000001.01000000.0000000A.sdmp, MpSigStub.exe, 00000013.00000000.18742830508.00007FF7D3A47000.00000002.00000001.01000000.0000000F.sdmp, MpSigStub.exe, 00000013.00000002.18819564832.00007FF7D3A47000.00000002.00000001.01000000.0000000F.sdmp, MpSigStub.exe, 00000013.00000003.18755716938.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCommu.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18752568256.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpUxAgent.pdb source: mpam-60574f34.exe, 00000010.00000003.18542110345.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18757096877.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WdFilter.pdb source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ProtectionManagement.pdb source: mpam-60574f34.exe, 00000010.00000003.18544926204.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18758774396.000001F8CDE41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpUxAgent.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18542110345.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18757096877.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WdNisDrv.pdb source: mpam-60574f34.exe, 00000010.00000003.18739844648.0000016C079A3000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MsMpEng.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18757615927.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpSigStub.pdb source: MpSigStub.exe, 00000007.00000003.18401631614.000001DE0F547000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000007.00000000.18387090699.00007FF6F4507000.00000002.00000001.01000000.0000000A.sdmp, MpSigStub.exe, 00000007.00000002.18489828227.00007FF6F4507000.00000002.00000001.01000000.0000000A.sdmp, MpSigStub.exe, 00000013.00000000.18742830508.00007FF7D3A47000.00000002.00000001.01000000.0000000F.sdmp, MpSigStub.exe, 00000013.00000002.18819564832.00007FF7D3A47000.00000002.00000001.01000000.0000000F.sdmp, MpSigStub.exe, 00000013.00000003.18755716938.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAdlElvtStub.pdb source: mpam-60574f34.exe, 00000010.00000002.18824267770.00007FF700EDF000.00000002.00000001.01000000.0000000E.sdmp, mpam-60574f34.exe, 00000010.00000000.18501623235.00007FF700EDF000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: MpOAV.pdb source: mpam-60574f34.exe, 00000010.00000003.18533279750.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754550374.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpOAV.dll0.16.dr
Source: Binary string: MpUpdate.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18756735348.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCmdRun.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18558489914.0000016C07986000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18752027678.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpRTP.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18535264051.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754931951.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAdlElvtStub.pdbGCTL source: mpam-60574f34.exe, 00000010.00000002.18824267770.00007FF700EDF000.00000002.00000001.01000000.0000000E.sdmp, mpam-60574f34.exe, 00000010.00000000.18501623235.00007FF700EDF000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: MpOAV.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18533279750.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754550374.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpOAV.dll0.16.dr
Source: Binary string: MpDetoursCopyAccelerator.pdb source: MpSigStub.exe, 00000013.00000003.18761941166.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCmdRun.pdb source: mpam-60574f34.exe, 00000010.00000003.18558489914.0000016C07986000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18752027678.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ConfigSecurityPolicy.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18750149036.000001F8CDE37000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCopyAccelerator.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18761414141.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18752921990.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp, MpCopyAccelerator.exe0.16.dr
Source: Binary string: WdNisDrv.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18739844648.0000016C079A3000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpDlpCmd.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18560328758.0000016C07986000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18753508768.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpDlpCmd.exe.16.dr
Source: Binary string: MpDetours.pdb source: mpam-60574f34.exe, 00000010.00000003.18531267121.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18753195690.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18761615816.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp, MpDetours.dll0.16.dr
Source: Binary string: WdDevFlt.pdb source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpSenseComm.pdb source: MpSigStub.exe, 00000013.00000003.18755428699.000001F8CDE4C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCommu.pdb source: MpSigStub.exe, 00000013.00000003.18752568256.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpDetoursCopyAccelerator.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18761941166.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAdlStub.pdbGCTL source: mpam-e428c3f6.exe, 00000003.00000000.18199651604.00007FF74E73F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: MpPayload.pdbGCTL source: mpengine.exe, 0000000C.00000002.18479667093.00007FF71C58B000.00000002.00000001.01000000.0000000D.sdmp, mpengine.exe, 0000000C.00000000.18476339200.00007FF71C58B000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: WdBoot.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NisSrv.pdbGCTL source: NisSrv.exe.16.dr
Source: Binary string: MpDlpCmd.pdb source: mpam-60574f34.exe, 00000010.00000003.18560328758.0000016C07986000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18753508768.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpDlpCmd.exe.16.dr
Source: Binary string: MsMpEng.pdb source: MpSigStub.exe, 00000013.00000003.18757615927.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCopyAccelerator.pdb source: MpSigStub.exe, 00000013.00000003.18761414141.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18752921990.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp, MpCopyAccelerator.exe0.16.dr
Source: Binary string: MpClient.pdbGCTL source: MpSigStub.exe, 00000007.00000003.18393894759.000001DE0F544000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WaaSMedicSvc.pdb source: waasmedic.20220526_155057_892.etl.23.dr
Source: Binary string: MpUpdate.pdb source: MpSigStub.exe, 00000013.00000003.18756735348.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpPayload.pdb source: mpengine.exe, 0000000C.00000002.18479667093.00007FF71C58B000.00000002.00000001.01000000.0000000D.sdmp, mpengine.exe, 0000000C.00000000.18476339200.00007FF71C58B000.00000002.00000001.01000000.0000000D.sdmp
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405C49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_00406873 FindFirstFileW,FindClose, 1_2_00406873
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_0040290B FindFirstFileW, 1_2_0040290B
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DADEC FindFirstFileW,FindNextFileW,FindClose,FindClose, 7_2_00007FF6F44DADEC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DB030 FindNextFileW,FindClose,FindFirstFileW, 7_2_00007FF6F44DB030
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F448F810 FindFirstFileW,FindNextFileW,FindClose,CloseHandle,CloseHandle, 7_2_00007FF6F448F810
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4502504 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 7_2_00007FF6F4502504
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A1B030 FindNextFileW,FindClose,FindFirstFileW, 19_2_00007FF7D3A1B030
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A1ADEC FindFirstFileW,FindNextFileW,FindClose,FindClose, 19_2_00007FF7D3A1ADEC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A42504 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 19_2_00007FF7D3A42504
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39CF810 FindFirstFileW,FindNextFileW,FindClose,CloseHandle,CloseHandle, 19_2_00007FF7D39CF810

Networking
barindex
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Source: WdNisDrv.sys.16.dr Static PE information: Found NDIS imports: FwpmTransactionAbort0, FwpmTransactionCommit0, FwpmTransactionBegin0, FwpmEngineOpen0, FwpmSubLayerAdd0, FwpmEngineClose0, FwpmFilterAdd0, FwpmCalloutAdd0, FwpmSubLayerDeleteByKey0, FwpmCalloutDeleteByKey0, FwpmFilterDeleteByKey0, FwpsCalloutUnregisterByKey0, FwpsQueryPacketInjectionState0, FwpsInjectTransportSendAsync0, FwpsStreamInjectAsync0, FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpsFlowRemoveContext0, FwpsFlowAssociateContext0, FwpsCalloutRegister2, FwpsCalloutUnregisterById0, FwpsAllocateNetBufferAndNetBufferList0, FwpsFreeNetBufferList0, FwpsCopyStreamDataToBuffer0, FwpsFlowAbort0
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://drive.google.com/uc?export=download&id=1c-6Y7E6EFCnEfeUqjiCzqb4bjj7oMV7b
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 209.197.3.8 209.197.3.8
Source: Joe Sandbox View IP Address: 20.189.173.22 20.189.173.22
Source: CasPol.exe, 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: CasPol.exe, 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://OGHYwH.com
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: CasPol.exe, 00000005.00000003.18602156620.0000000020831000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: CasPol.exe, 00000005.00000003.18602156620.0000000020831000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: CasPol.exe, 00000005.00000002.23252711793.000000001F909000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23253044443.000000001F941000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: CasPol.exe, 00000005.00000003.19683625040.000000001F957000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23253192039.000000001F95A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: NisSrv.exe.16.dr String found in binary or memory: http://canonicalizer.ucsuri.tcs/68007400740070003a002f002f00https://F
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: CasPol.exe, 00000005.00000002.23253044443.000000001F941000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23255549826.000000002079C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: CasPol.exe, 00000005.00000002.23252711793.000000001F909000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23253044443.000000001F941000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: CasPol.exe, 00000005.00000003.18459747894.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23220195823.0000000001389000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18453568729.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000002.18817978834.000001F8CEA5A000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18808191584.000001F8CEA5A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 00000005.00000003.18602156620.0000000020831000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.defence.gov.au/pki0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: CasPol.exe, 00000005.00000003.18459747894.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23220195823.0000000001389000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18453568729.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000002.18817978834.000001F8CEA5A000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18808191584.000001F8CEA5A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CasPol.exe, 00000005.00000002.23252711793.000000001F909000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23253044443.000000001F941000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: MpSigStub.exe, 00000013.00000003.18808585691.000001F8CEA95000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18809059455.000001F8CEAA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mV
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: CasPol.exe, 00000005.00000003.18601190951.000000002072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: CasPol.exe, 00000005.00000003.18600919578.0000000020866000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682774918.000000002073F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682296383.0000000020824000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: CasPol.exe, 00000005.00000003.18602156620.0000000020831000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: CasPol.exe, 00000005.00000002.23252207253.000000001F880000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en-
Source: CasPol.exe, 00000005.00000003.18600841922.000000002075C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221121866.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0
Source: CasPol.exe, 00000005.00000002.23252207253.000000001F880000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabu
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://eca.hinet.net/repository/CRL2/CA.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05
Source: svchost.exe, 00000004.00000003.18264156503.0000016033E8D000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac4xvos2si2lmfknfcdjashelknq_6853/hfnkpim
Source: svchost.exe, 00000004.00000003.18264156503.0000016033E8D000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acawi27tahsqmjecluxobzvjkuqq_2696/jflookg
Source: edb.log.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad26pg2nrxgqly2ia5w7vo6eiqza_2021.9.7.114
Source: svchost.exe, 00000004.00000003.18264156503.0000016033E8D000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/b4fblichp2jogjdq2f6x2fndde_96.0.4642.0/96
Source: edb.log.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ccqwc52cyybdcncouijnt6kpaq_2021.8.17.1300
Source: edb.log.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dvzedcdxjkqbllsukvc5xx3sla_297/lmelglejhe
Source: svchost.exe, 00000004.00000003.18264156503.0000016033E8D000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/eqxvmyahb2yb37zdb4o4kdupqe_20210908.39616
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: CasPol.exe, 00000005.00000003.18602156620.0000000020831000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.asfaltolargo.pt
Source: CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.asfaltolargo.pt(
Source: MpSigStub.exe, 00000013.00000003.18808585691.000001F8CEA95000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000002.18818438522.000001F8CEA95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://microsoft.co
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://ocsp.digicert.com0L
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.eca.hinet.net/OCSP/ocspG2sha20
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.pki.gva.es0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601190951.000000002072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: svchost.exe, 0000001D.00000002.23220485437.000002C1682B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://passport.net/tb
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://policy.camerfirma.com0
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: CasPol.exe, 00000005.00000002.23253044443.000000001F941000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23255549826.000000002079C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0-
Source: CasPol.exe, 00000005.00000002.23253044443.000000001F941000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23255549826.000000002079C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: svchost.exe, 00000004.00000003.18263630598.0000016033E3A000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://r4---sn-4g5edn6r.gvt1.com/edgedl/release2/chrome/m7rvnjoy2l3r3o6gis4j26t4ii_93.0.4577.63/93.0
Source: svchost.exe, 00000004.00000003.18264715234.0000016033EF8000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://r4---sn-5hnekn7k.gvt1.com/edgedl/release2/chrome/acb3kitere6jimdp6rrtasanb2aq_93.0.4577.82/93
Source: edb.log.4.dr String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvODZmQUFYS2VOaGowdjd
Source: edb.log.4.dr String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome/acb3kitere6jimdp6rrtasanb2aq_93.0.4577.82/93.0.457
Source: edb.log.4.dr String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome/m7rvnjoy2l3r3o6gis4j26t4ii_93.0.4577.63/93.0.4577.
Source: edb.log.4.dr String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/aciwgjnovhktokhzyboslawih45a_2700/jflook
Source: edb.log.4.dr String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/acze3h5f67uhtnjsyv6pabzn277q_298/lmelgle
Source: svchost.exe, 00000004.00000003.18264499048.0000016033ECF000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/dp66roauucji6olf7ycwe24lea_6869/hfnkpiml
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://s2.symcb.com0
Source: MpSigStub.exe, 00000013.00000003.18771865855.000001F8CDE46000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18771022833.000001F8CDE35000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.mic2M
Source: MpSigStub.exe, 00000013.00000003.18752568256.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: edb.log.4.dr String found in binary or memory: http://storage.googleapis.com/update-delta/ggkkehgbnfjpeggfpleeakpidbkibbmn/2021.9.13.1142/2021.9.7.
Source: edb.log.4.dr String found in binary or memory: http://storage.googleapis.com/update-delta/gkmgaooipdjhmangpemjhigmamcehddo/93.269.200/92.267.200/17
Source: svchost.exe, 00000004.00000003.18264499048.0000016033ECF000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr String found in binary or memory: http://storage.googleapis.com/update-delta/jamhcnnkihinmdlkakkaopbjbbcngflc/96.0.4648.2/96.0.4642.0/
Source: edb.log.4.dr String found in binary or memory: http://storage.googleapis.com/update-delta/khaoiebndkojlmppeemjhbpbandiljpe/45/43/19f2dc8e4c5c5d0383
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://sv.symcd.com0&
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.acabogacia.org/doc0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.acabogacia.org0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es00
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ancert.com/cps0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: mpam-60574f34.exe, 00000010.00000003.18740725593.0000016C07975000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18740268669.0000016C07975000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682296383.0000000020824000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.chambersign.org1
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.comsign.co.il/cps0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: CasPol.exe, 00000005.00000003.18600919578.0000000020866000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601190951.000000002072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18602156620.0000000020831000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.defence.gov.au/pki0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: CasPol.exe, 00000005.00000003.19683625040.000000001F957000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23253192039.000000001F95A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: CasPol.exe, 00000005.00000003.19683625040.000000001F957000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23253192039.000000001F95A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.disig.sk/ca0f
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682296383.0000000020824000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.dnie.es/dpc0
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-me.lv/repository0
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: CasPol.exe, 00000005.00000003.18602156620.0000000020831000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682407629.0000000020834000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: CasPol.exe, 00000005.00000003.18601190951.000000002072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: CasPol.exe, 00000005.00000002.23256187565.0000000020822000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682296383.0000000020824000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.eme.lv/repository0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682296383.0000000020824000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.globaltrust.info0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.globaltrust.info0=
Source: CasPol.exe, 00000005.00000003.18600919578.0000000020866000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: MpSigStub.exe, 00000013.00000003.18808585691.000001F8CEA95000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18809059455.000001F8CEAA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.c_
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.oaticerts.com/repository.
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682296383.0000000020824000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.gva.es/cps0
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.gva.es/cps0%
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682472622.000000002083C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.rcsc.lt/repository0
Source: CasPol.exe, 00000005.00000003.18600919578.0000000020866000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sk.ee/cps/0
Source: CasPol.exe, 00000005.00000003.18600919578.0000000020866000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.19682774918.000000002073F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18600919578.0000000020866000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ssc.lt/cps03
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601190951.000000002072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601190951.000000002072C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.symauth.com/cps0(
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.symauth.com/rpa00
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: CasPol.exe, 00000005.00000003.18600919578.0000000020866000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: mpam-60574f34.exe, 00000010.00000003.18533279750.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754550374.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpOAV.dll0.16.dr String found in binary or memory: http://www.validationtest.contoso.com/test%ld.htmlMpOAV_ForceDeepScan
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.vmware.com/0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.vmware.com/0/
Source: CasPol.exe, 00000005.00000003.18602026559.0000000020837000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: CasPol.exe, 00000005.00000002.23255092763.0000000020728000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23253044443.000000001F941000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: CasPol.exe, 00000005.00000002.23255092763.0000000020728000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23253044443.000000001F941000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/InlineSignup.aspx?w=
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=806015
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976530622.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976530622.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/msangcwam
Source: edb.log.4.dr String found in binary or memory: https://clients2.google.com/service/check2?crx3=true&appid=%7B430FD4D0-B729-4F61-AA34-91526481799D%7
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: CasPol.exe, 00000005.00000003.18453888800.00000000013E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: CasPol.exe, 00000005.00000003.18459747894.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23219964862.0000000001367000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://doc-0g-34-docs.googleusercontent.com/
Source: CasPol.exe, 00000005.00000003.18459747894.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18453888800.00000000013E1000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23220195823.0000000001389000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18459694691.00000000013A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://doc-0g-34-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/glr6brug
Source: CasPol.exe, 00000005.00000002.23219964862.0000000001367000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://doc-0g-34-docs.googleusercontent.com/s_
Source: CasPol.exe, 00000005.00000002.23219609628.000000000132B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/6
Source: CasPol.exe, 00000005.00000002.23219609628.000000000132B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/V%-
Source: CasPol.exe, 00000005.00000002.23219964862.0000000001367000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1c-6Y7E6EFCnEfeUqjiCzqb4bjj7oMV7b
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://eca.hinet.net/repository0
Source: edb.log.4.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: mpam-60574f34.exe, 00000010.00000003.18740725593.0000016C07975000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18740268669.0000016C07975000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Azure/azure-storage-cpp)
Source: mpam-60574f34.exe, 00000010.00000003.18740725593.0000016C07975000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18740268669.0000016C07975000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Microsoft/cpprestsdk)
Source: mpam-60574f34.exe, 00000010.00000003.18740725593.0000016C07975000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18740268669.0000016C07975000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/open-source-parsers/jsoncpp.git)
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.liv
Source: svchost.exe, 0000001D.00000003.21977118694.000002C168D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23220023205.000002C168260000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977227438.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977351770.000002C168D40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000001D.00000002.23221786081.000002C168D6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601er
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977227438.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000001D.00000002.23220023205.000002C168260000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977227438.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000001D.00000003.21977118694.000002C168D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977351770.000002C168D40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageApprover.srfe.com
Source: svchost.exe, 0000001D.00000003.21977118694.000002C168D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23220023205.000002C168260000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977227438.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977351770.000002C168D40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000001D.00000002.23220023205.000002C168260000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221293391.000002C168D13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/geter
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srfer
Source: svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000001D.00000003.21977118694.000002C168D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23220023205.000002C168260000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977351770.000002C168D40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000001D.00000002.23221786081.000002C168D6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfnfig.xml
Source: svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000001D.00000003.21977118694.000002C168D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23220023205.000002C168260000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977227438.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977351770.000002C168D40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cplive.com
Source: svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfssuer
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976530622.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000001D.00000002.23221786081.000002C168D6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977501299.000002C168D6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfn
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502Issuer
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976530622.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976530622.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976530622.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976530622.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976530622.000002C168D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977267020.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976659587.000002C168D2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000001D.00000003.21977118694.000002C168D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23220023205.000002C168260000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977351770.000002C168D40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000001D.00000003.21977118694.000002C168D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.21977351770.000002C168D40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000001D.00000002.23220023205.000002C168260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf#h
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srfer
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/lip
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000001D.00000003.21976982682.000002C168D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/retention.srfrf
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: CasPol.exe, 00000005.00000002.23245577235.000000001D986000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://owWZDyjXwQrXMrJH.or
Source: CasPol.exe, 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23246237802.000000001D9BE000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23245892965.000000001D994000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://owWZDyjXwQrXMrJH.org
Source: CasPol.exe, 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://owWZDyjXwQrXMrJH.org8?
Source: CasPol.exe, 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://owWZDyjXwQrXMrJH.orgt-
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repository.luxtrust.lu0
Source: svchost.exe, 0000001D.00000002.23219818127.000002C168241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.23221533613.000002C168D37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://signup.live.com/signup.aspx
Source: NisSrv.exe.16.dr String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us
Source: NisSrv.exe.16.dr String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us
Source: CasPol.exe, 00000005.00000003.18601505288.000000002083F000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: CasPol.exe, 00000005.00000003.19682976608.0000000020819000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/address/)1(0&
Source: CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.catcert.net/verarrel
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.catcert.net/verarrel05
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: CasPol.exe, 00000005.00000003.18600600714.0000000020744000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netlock.hu/docs/
Source: CasPol.exe, 00000005.00000003.18599518207.00000000207A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netlock.net/docs
Source: CasPol.exe, 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: CasPol.exe, 00000005.00000003.18601003280.0000000020731000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.18601324854.0000000020738000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: CasPol.exe, 00000005.00000002.23245153177.000000001D935000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_004056DE
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_0040755C 1_2_0040755C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_00406D85 1_2_00406D85
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_6F3D1BFF 1_2_6F3D1BFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A24745 1_2_02A24745
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A106AA 1_2_02A106AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A116AF 1_2_02A116AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A102B7 1_2_02A102B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C2BD 1_2_02A1C2BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11A89 1_2_02A11A89
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10A90 1_2_02A10A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A116E8 1_2_02A116E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10EE8 1_2_02A10EE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A102EE 1_2_02A102EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10AC6 1_2_02A10AC6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11AD0 1_2_02A11AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C2DF 1_2_02A1C2DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1BE2F 1_2_02A1BE2F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10A32 1_2_02A10A32
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1023D 1_2_02A1023D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1063E 1_2_02A1063E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11671 1_2_02A11671
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10671 1_2_02A10671
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10E73 1_2_02A10E73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1167F 1_2_02A1167F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1027E 1_2_02A1027E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A16E42 1_2_02A16E42
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1724E 1_2_02A1724E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11651 1_2_02A11651
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10A53 1_2_02A10A53
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A187AF 1_2_02A187AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10BB4 1_2_02A10BB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C387 1_2_02A1C387
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11B8B 1_2_02A11B8B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1038F 1_2_02A1038F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10F97 1_2_02A10F97
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11796 1_2_02A11796
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A257E5 1_2_02A257E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A107EA 1_2_02A107EA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10BF9 1_2_02A10BF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11BF9 1_2_02A11BF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A107C8 1_2_02A107C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A117CC 1_2_02A117CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C3D4 1_2_02A1C3D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A103D6 1_2_02A103D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10FDA 1_2_02A10FDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11729 1_2_02A11729
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10F2F 1_2_02A10F2F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1872E 1_2_02A1872E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11B05 1_2_02A11B05
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A17F07 1_2_02A17F07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10B0A 1_2_02A10B0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1031D 1_2_02A1031D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A17B6D 1_2_02A17B6D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10B7C 1_2_02A10B7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10B49 1_2_02A10B49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A18B53 1_2_02A18B53
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10757 1_2_02A10757
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11756 1_2_02A11756
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A108A7 1_2_02A108A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11CA9 1_2_02A11CA9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C4B7 1_2_02A1C4B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A118B8 1_2_02A118B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10CBB 1_2_02A10CBB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A22C8B 1_2_02A22C8B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10096 1_2_02A10096
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1049B 1_2_02A1049B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A118E9 1_2_02A118E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A18CEF 1_2_02A18CEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A108F4 1_2_02A108F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10CFA 1_2_02A10CFA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A188C2 1_2_02A188C2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A104D1 1_2_02A104D1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11CD9 1_2_02A11CD9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A100DA 1_2_02A100DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10421 1_2_02A10421
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10829 1_2_02A10829
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10C28 1_2_02A10C28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A18C2B 1_2_02A18C2B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A18837 1_2_02A18837
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11839 1_2_02A11839
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10005 1_2_02A10005
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11804 1_2_02A11804
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11007 1_2_02A11007
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A23C0E 1_2_02A23C0E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10014 1_2_02A10014
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A2401A 1_2_02A2401A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10060 1_2_02A10060
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10C6C 1_2_02A10C6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1086C 1_2_02A1086C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A11C75 1_2_02A11C75
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1187C 1_2_02A1187C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1045B 1_2_02A1045B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A109A4 1_2_02A109A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10DAC 1_2_02A10DAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A175B1 1_2_02A175B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A119B6 1_2_02A119B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A101BA 1_2_02A101BA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1BD88 1_2_02A1BD88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1018A 1_2_02A1018A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A18198 1_2_02A18198
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A189E3 1_2_02A189E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A109E2 1_2_02A109E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A175E7 1_2_02A175E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A119EA 1_2_02A119EA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10DF2 1_2_02A10DF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A101FC 1_2_02A101FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A105C2 1_2_02A105C2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A171C4 1_2_02A171C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A171CD 1_2_02A171CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A171D3 1_2_02A171D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10930 1_2_02A10930
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10D33 1_2_02A10D33
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1010B 1_2_02A1010B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1050F 1_2_02A1050F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1191E 1_2_02A1191E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10D66 1_2_02A10D66
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1196D 1_2_02A1196D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1196F 1_2_02A1196F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1897B 1_2_02A1897B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1057C 1_2_02A1057C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1054C 1_2_02A1054C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1014F 1_2_02A1014F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1614E 1_2_02A1614E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A18154 1_2_02A18154
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1BD57 1_2_02A1BD57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A10959 1_2_02A10959
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D666B63 5_2_1D666B63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D66A160 5_2_1D66A160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D669890 5_2_1D669890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D669548 5_2_1D669548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D85EB58 5_2_1D85EB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D85C408 5_2_1D85C408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_205FD148 5_2_205FD148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_205F1108 5_2_205F1108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_205FB2C0 5_2_205FB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_205F3378 5_2_205F3378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_205F4A88 5_2_205F4A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_205F4938 5_2_205F4938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_20616060 5_2_20616060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_20610040 5_2_20610040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_2061D170 5_2_2061D170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_206172D8 5_2_206172D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_2061D169 5_2_2061D169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_2061BA88 5_2_2061BA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_210B5B38 5_2_210B5B38
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4483728 7_2_00007FF6F4483728
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44786BC 7_2_00007FF6F44786BC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F447FF90 7_2_00007FF6F447FF90
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F448D038 7_2_00007FF6F448D038
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44E7600 7_2_00007FF6F44E7600
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44A15F8 7_2_00007FF6F44A15F8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DF76C 7_2_00007FF6F44DF76C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44F77FC 7_2_00007FF6F44F77FC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F449A818 7_2_00007FF6F449A818
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44EB88C 7_2_00007FF6F44EB88C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44B490C 7_2_00007FF6F44B490C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F449B20C 7_2_00007FF6F449B20C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44EC21C 7_2_00007FF6F44EC21C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44BA288 7_2_00007FF6F44BA288
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4499278 7_2_00007FF6F4499278
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44A0320 7_2_00007FF6F44A0320
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44F837C 7_2_00007FF6F44F837C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DE410 7_2_00007FF6F44DE410
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4471420 7_2_00007FF6F4471420
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44A6480 7_2_00007FF6F44A6480
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44F2480 7_2_00007FF6F44F2480
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4502504 7_2_00007FF6F4502504
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F449C52C 7_2_00007FF6F449C52C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44E9520 7_2_00007FF6F44E9520
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F45034D4 7_2_00007FF6F45034D4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44D1D78 7_2_00007FF6F44D1D78
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44EDD9C 7_2_00007FF6F44EDD9C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44F1E00 7_2_00007FF6F44F1E00
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44D2DD4 7_2_00007FF6F44D2DD4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44EBE48 7_2_00007FF6F44EBE48
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44D5ED0 7_2_00007FF6F44D5ED0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4481FA8 7_2_00007FF6F4481FA8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F448DFB4 7_2_00007FF6F448DFB4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F449FFA8 7_2_00007FF6F449FFA8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44F5F9C 7_2_00007FF6F44F5F9C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44EC034 7_2_00007FF6F44EC034
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44A502C 7_2_00007FF6F44A502C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F448EFCC 7_2_00007FF6F448EFCC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44D7050 7_2_00007FF6F44D7050
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44ED058 7_2_00007FF6F44ED058
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44FB058 7_2_00007FF6F44FB058
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44E7108 7_2_00007FF6F44E7108
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F447B0C8 7_2_00007FF6F447B0C8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44F1950 7_2_00007FF6F44F1950
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F447B944 7_2_00007FF6F447B944
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44ED9D0 7_2_00007FF6F44ED9D0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44A0AB0 7_2_00007FF6F44A0AB0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44EBA74 7_2_00007FF6F44EBA74
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F449AA68 7_2_00007FF6F449AA68
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44E9B34 7_2_00007FF6F44E9B34
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44A1C10 7_2_00007FF6F44A1C10
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4493C87 7_2_00007FF6F4493C87
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44EBC60 7_2_00007FF6F44EBC60
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4479CFC 7_2_00007FF6F4479CFC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4491D00 7_2_00007FF6F4491D00
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44ECCC8 7_2_00007FF6F44ECCC8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44A3CE0 7_2_00007FF6F44A3CE0
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Code function: 12_2_00007FF71C581DC4 12_2_00007FF71C581DC4
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Code function: 12_2_00007FF71C58435C 12_2_00007FF71C58435C
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Code function: 12_2_00007FF71C584D14 12_2_00007FF71C584D14
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Code function: 12_2_00007FF71C5846B4 12_2_00007FF71C5846B4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39D9278 19_2_00007FF7D39D9278
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39C3728 19_2_00007FF7D39C3728
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39B86BC 19_2_00007FF7D39B86BC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39CD038 19_2_00007FF7D39CD038
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39C1FA8 19_2_00007FF7D39C1FA8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39BFF90 19_2_00007FF7D39BFF90
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A434D4 19_2_00007FF7D3A434D4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A42504 19_2_00007FF7D3A42504
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39B1420 19_2_00007FF7D39B1420
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39E6480 19_2_00007FF7D39E6480
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A32480 19_2_00007FF7D3A32480
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A1E410 19_2_00007FF7D3A1E410
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39E0320 19_2_00007FF7D39E0320
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A3837C 19_2_00007FF7D3A3837C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2C21C 19_2_00007FF7D3A2C21C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39FA288 19_2_00007FF7D39FA288
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39DB20C 19_2_00007FF7D39DB20C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39F490C 19_2_00007FF7D39F490C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39DA818 19_2_00007FF7D39DA818
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2B88C 19_2_00007FF7D3A2B88C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A377FC 19_2_00007FF7D3A377FC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A1F76C 19_2_00007FF7D3A1F76C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39E15F8 19_2_00007FF7D39E15F8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A27600 19_2_00007FF7D3A27600
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39DC52C 19_2_00007FF7D39DC52C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A29520 19_2_00007FF7D3A29520
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2CCC8 19_2_00007FF7D3A2CCC8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39D1D00 19_2_00007FF7D39D1D00
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39B9CFC 19_2_00007FF7D39B9CFC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39E3CE0 19_2_00007FF7D39E3CE0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39D3C87 19_2_00007FF7D39D3C87
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2BC60 19_2_00007FF7D3A2BC60
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39E1C10 19_2_00007FF7D39E1C10
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A29B34 19_2_00007FF7D3A29B34
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39E0AB0 19_2_00007FF7D39E0AB0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2BA74 19_2_00007FF7D3A2BA74
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39DAA68 19_2_00007FF7D39DAA68
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2D9D0 19_2_00007FF7D3A2D9D0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39BB944 19_2_00007FF7D39BB944
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A31950 19_2_00007FF7D3A31950
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39BB0C8 19_2_00007FF7D39BB0C8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A27108 19_2_00007FF7D3A27108
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A17050 19_2_00007FF7D3A17050
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2C034 19_2_00007FF7D3A2C034
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39E502C 19_2_00007FF7D39E502C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A3B058 19_2_00007FF7D3A3B058
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2D058 19_2_00007FF7D3A2D058
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39CEFCC 19_2_00007FF7D39CEFCC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39CDFB4 19_2_00007FF7D39CDFB4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A35F9C 19_2_00007FF7D3A35F9C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39DFFA8 19_2_00007FF7D39DFFA8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A15ED0 19_2_00007FF7D3A15ED0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2BE48 19_2_00007FF7D3A2BE48
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A12DD4 19_2_00007FF7D3A12DD4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A2DD9C 19_2_00007FF7D3A2DD9C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A31E00 19_2_00007FF7D3A31E00
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A11D78 19_2_00007FF7D3A11D78
PE file contains strange resources
Source: MpAsDesc.dll.16.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Section loaded: edgegdi.dll
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Section loaded: sfc.dll
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Section loaded: phoneinfo.dll
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\NisSrv.exe Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: edgegdi.dll
Creates driver files
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdBoot.sys Jump to behavior
Spawns drivers
Source: unknown Driver loaded: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EBBB10C2-099A-4A41-A364-F566D3127AB4}\MpKslDrv.sys
PE file contains more sections than normal
Source: WdFilter.sys.16.dr Static PE information: Number of sections : 11 > 10
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Deletes files inside the Windows folder
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File deleted: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpengine.dll Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_0040352D
Found potential string decryption / allocating functions
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: String function: 00007FF6F4480D88 appears 41 times
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: String function: 00007FF6F4480DB4 appears 56 times
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: String function: 00007FF6F44DBAAC appears 36 times
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: String function: 00007FF7D3A1BAAC appears 36 times
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: String function: 00007FF7D39C0D88 appears 41 times
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: String function: 00007FF7D39C0DB4 appears 56 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A266BD NtProtectVirtualMemory, 1_2_02A266BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A24745 LoadLibraryA,NtAllocateVirtualMemory, 1_2_02A24745
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F448C444 NtQueryInformationProcess,NtQueryInformationProcess,FindCloseChangeNotification,CloseHandle, 7_2_00007FF6F448C444
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4495DB4 NtQueryInformationFile,NtQueryInformationFile,RtlNtStatusToDosError, 7_2_00007FF6F4495DB4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4489FF0 NtSetInformationFile, 7_2_00007FF6F4489FF0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4495B80 ReadFile,FlushFileBuffers,SetEndOfFile,NtSetInformationFile, 7_2_00007FF6F4495B80
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39CC444 NtQueryInformationProcess,NtQueryInformationProcess,FindCloseChangeNotification,CloseHandle, 19_2_00007FF7D39CC444
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39D5B80 ReadFile,FlushFileBuffers,SetEndOfFile,NtSetInformationFile, 19_2_00007FF7D39D5B80
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39C9FF0 NtSetInformationFile, 19_2_00007FF7D39C9FF0
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39D5DB4 NtQueryInformationFile,NtQueryInformationFile,RtlNtStatusToDosError, 19_2_00007FF7D39D5DB4
PE file contains executable resources (Code or Archives)
Source: mpengine.dll.3.dr Static PE information: Resource name: PACKEDBINARY type: PE32+ executable (native) x86-64, for MS Windows
Source: mpengine.dll.3.dr Static PE information: Resource name: PACKEDBINARY type: PE32+ executable (native) x86-64, for MS Windows
Source: mpengine.dll.3.dr Static PE information: Resource name: PACKEDBINARY type: PE32+ executable (native) x86-64, for MS Windows
Source: mpengine.dll.3.dr Static PE information: Resource name: PACKEDBINARY type: PE32+ executable (GUI) x86-64, for MS Windows
Source: mpengine.dll.3.dr Static PE information: Resource name: PACKEDBINARY type: PE32+ executable (DLL) (console) x86-64, for MS Windows
Source: mpengine.dll.3.dr Static PE information: Resource name: PACKEDBINARY type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: mpengine.dll.3.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: ProtectionManagement.dll.mui.16.dr Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: ProtectionManagement.dll.mui0.16.dr Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: MpAsDesc.dll.mui3.16.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: ProtectionManagement.dll.mui1.16.dr Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: ProtectionManagement.dll.mui2.16.dr Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: ProtectionManagement.dll.mui4.16.dr Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: WdFilter.sys.16.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: ProtectionManagement.dll.mui6.16.dr Static PE information: Resource name: RT_STRING type: COM executable for DOS
PE file does not import any functions
Source: MpEvMsg.dll.mui5.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui11.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui2.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui21.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui28.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui2.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui18.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui14.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui2.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui24.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui5.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui8.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui41.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui44.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui31.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui34.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui51.16.dr Static PE information: No import functions for PE file found
Source: ProtectionManagement.dll.mui2.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui22.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui37.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui17.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui8.16.dr Static PE information: No import functions for PE file found
Source: ProtectionManagement.dll.mui5.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui10.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui30.16.dr Static PE information: No import functions for PE file found
Source: mpasdlta.vdm.3.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui25.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui36.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui23.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui46.16.dr Static PE information: No import functions for PE file found
Source: mpavdlta.vdm.3.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui13.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui13.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui13.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui3.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui4.16.dr Static PE information: No import functions for PE file found
Source: ProtectionManagement.dll.mui4.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui19.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui29.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui24.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui12.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui47.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui12.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui9.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui52.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui23.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui5.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui3.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui9.16.dr Static PE information: No import functions for PE file found
Source: mpasbase.vdm.3.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui35.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui40.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui9.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui18.16.dr Static PE information: No import functions for PE file found
Source: ProtectionManagement.dll.mui3.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui11.16.dr Static PE information: No import functions for PE file found
Source: ProtectionManagement.dll.mui6.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui21.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui19.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui10.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui30.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui29.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui3.16.dr Static PE information: No import functions for PE file found
Source: ProtectionManagement.dll.mui.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui4.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui14.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui1.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui22.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui53.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui12.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui17.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui6.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui0.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui42.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui33.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui1.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui28.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui48.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui25.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui4.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui10.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui45.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui50.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui7.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui16.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui26.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui0.16.dr Static PE information: No import functions for PE file found
Source: mpavbase.vdm.3.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui39.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui7.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui16.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui26.16.dr Static PE information: No import functions for PE file found
Source: ProtectionManagement.dll.mui1.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui0.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui49.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui7.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui20.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui6.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui6.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui1.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui32.16.dr Static PE information: No import functions for PE file found
Source: HPSUPD-Win32Exe.exe.1.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui27.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui27.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui20.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui43.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui38.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui15.16.dr Static PE information: No import functions for PE file found
Source: mpuxagent.dll.mui15.16.dr Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.mui11.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.16.dr Static PE information: No import functions for PE file found
Source: ProtectionManagement.dll.mui0.16.dr Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.mui8.16.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamevm3ddevapi64-release.dll> vs SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe
Enables security privileges
Source: C:\Windows\System32\wevtutil.exe Process token adjusted: Security Jump to behavior
Source: mpavdlta.vdm.3.dr Static PE information: Section: .rsrc ZLIB complexity 0.999874238483
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@21/253@0/7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F447B0C8 OpenSCManagerW,OpenServiceW,CloseServiceHandle,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle, 7_2_00007FF6F447B0C8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4491AE0 FindResourceW,GetLastError,LoadResource,GetLastError,LockResource,GetLastError,SizeofResource,GetLastError, 7_2_00007FF6F4491AE0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Virustotal: Detection: 30%
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe ReversingLabs: Detection: 22%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe"
Source: unknown Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe "C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-e428c3f6.exe" /q WD
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe /stub 1.1.18500.10 /payload 1.367.502.0 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-e428c3f6.exe /q WD
Source: unknown Process created: C:\Windows\System32\wevtutil.exe C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\TEMP\3FCB5F68-CD33-FF2F-34AE-798C9A7026D4.man
Source: C:\Windows\System32\wevtutil.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\wevtutil.exe C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\TEMP\3FCB5F68-CD33-FF2F-34AE-798C9A7026D4.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
Source: C:\Windows\System32\wevtutil.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe C:\ProgramData\Microsoft\Windows Defender\Scans\\MpPayloadData\mpengine.exe
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-60574f34.exe
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe /stub 1.1.18500.10 /payload 4.18.2203.5 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-60574f34.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: unknown Process created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\NisSrv.exe C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\NisSrv.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe" Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe /stub 1.1.18500.10 /payload 1.367.502.0 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-e428c3f6.exe /q WD Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe /stub 1.1.18500.10 /payload 4.18.2203.5 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-60574f34.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_0040352D
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DF118 LookupPrivilegeValueW,GetCurrentProcess,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle, 7_2_00007FF6F44DF118
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A1F118 LookupPrivilegeValueW,GetCurrentProcess,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle, 19_2_00007FF7D3A1F118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File created: C:\Users\user\AppData\Local\Temp\nsc7A1A.tmp Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_004021AA CoCreateInstance, 1_2_004021AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 1_2_0040498A
Source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18605566116.0000016C07991000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18719421934.0000016C079A1000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18762644734.000001F8CDE43000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Select ActionPA6Block executable content from email client and webmail;Block all Office applications from creating child processes:Block Office applications from creating executable contentBBlock Office applications from injecting code into other processesIBlock JavaScript or VBScript from launching downloaded executable content1Block execution of potentially obfuscated scripts'Block Win32 API calls from Office macro`Block executable files from running unless they meet a prevalence, age, or trusted list criteria*Use advanced protection against ransomwareYBlock credential stealing from the Windows local security authority subsystem (lsass.exe)@Block process creations originating from PSExec and WMI commands8Block untrusted and unsigned processes that run from USBJBlock only Office communication applications from creating child processes0Block Adobe Reader from creating child processesPA)Antimalware engine has stopped responding
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F448B1C4 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,GetLastError,Process32FirstW,GetLastError,Process32NextW,GetLastError,FindCloseChangeNotification,CloseHandle, 7_2_00007FF6F448B1C4
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8572:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4968:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:9144:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:5416:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4968:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:5416:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:8572:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:9144:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dado Jump to behavior
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: ConfigSecurityPolicy.pdb source: MpSigStub.exe, 00000013.00000003.18750149036.000001F8CDE37000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAzSubmit.pdb source: MpSigStub.exe, 00000013.00000003.18751240013.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NisSrv.pdb source: NisSrv.exe.16.dr
Source: Binary string: MpRTP.pdb source: mpam-60574f34.exe, 00000010.00000003.18535264051.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754931951.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WdBoot.pdb source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAdlStub.pdb source: mpam-e428c3f6.exe, 00000003.00000000.18199651604.00007FF74E73F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: WdFilter.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAzSubmit.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18751240013.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpSenseComm.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18755428699.000001F8CDE4C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpClient.pdb source: MpSigStub.exe, 00000007.00000003.18393894759.000001DE0F544000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WdDevFlt.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpDetours.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18531267121.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18753195690.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18761615816.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp, MpDetours.dll0.16.dr
Source: Binary string: ProtectionManagement.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18544926204.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18758774396.000001F8CDE41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpSigStub.pdbGCTL source: MpSigStub.exe, 00000007.00000003.18401631614.000001DE0F547000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000007.00000000.18387090699.00007FF6F4507000.00000002.00000001.01000000.0000000A.sdmp, MpSigStub.exe, 00000007.00000002.18489828227.00007FF6F4507000.00000002.00000001.01000000.0000000A.sdmp, MpSigStub.exe, 00000013.00000000.18742830508.00007FF7D3A47000.00000002.00000001.01000000.0000000F.sdmp, MpSigStub.exe, 00000013.00000002.18819564832.00007FF7D3A47000.00000002.00000001.01000000.0000000F.sdmp, MpSigStub.exe, 00000013.00000003.18755716938.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCommu.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18752568256.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpUxAgent.pdb source: mpam-60574f34.exe, 00000010.00000003.18542110345.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18757096877.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WdFilter.pdb source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ProtectionManagement.pdb source: mpam-60574f34.exe, 00000010.00000003.18544926204.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18758774396.000001F8CDE41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpUxAgent.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18542110345.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18757096877.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WdNisDrv.pdb source: mpam-60574f34.exe, 00000010.00000003.18739844648.0000016C079A3000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MsMpEng.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18757615927.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpSigStub.pdb source: MpSigStub.exe, 00000007.00000003.18401631614.000001DE0F547000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000007.00000000.18387090699.00007FF6F4507000.00000002.00000001.01000000.0000000A.sdmp, MpSigStub.exe, 00000007.00000002.18489828227.00007FF6F4507000.00000002.00000001.01000000.0000000A.sdmp, MpSigStub.exe, 00000013.00000000.18742830508.00007FF7D3A47000.00000002.00000001.01000000.0000000F.sdmp, MpSigStub.exe, 00000013.00000002.18819564832.00007FF7D3A47000.00000002.00000001.01000000.0000000F.sdmp, MpSigStub.exe, 00000013.00000003.18755716938.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAdlElvtStub.pdb source: mpam-60574f34.exe, 00000010.00000002.18824267770.00007FF700EDF000.00000002.00000001.01000000.0000000E.sdmp, mpam-60574f34.exe, 00000010.00000000.18501623235.00007FF700EDF000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: MpOAV.pdb source: mpam-60574f34.exe, 00000010.00000003.18533279750.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754550374.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpOAV.dll0.16.dr
Source: Binary string: MpUpdate.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18756735348.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCmdRun.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18558489914.0000016C07986000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18752027678.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpRTP.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18535264051.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754931951.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAdlElvtStub.pdbGCTL source: mpam-60574f34.exe, 00000010.00000002.18824267770.00007FF700EDF000.00000002.00000001.01000000.0000000E.sdmp, mpam-60574f34.exe, 00000010.00000000.18501623235.00007FF700EDF000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: MpOAV.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18533279750.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18754550374.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpOAV.dll0.16.dr
Source: Binary string: MpDetoursCopyAccelerator.pdb source: MpSigStub.exe, 00000013.00000003.18761941166.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCmdRun.pdb source: mpam-60574f34.exe, 00000010.00000003.18558489914.0000016C07986000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18752027678.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ConfigSecurityPolicy.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18750149036.000001F8CDE37000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCopyAccelerator.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18761414141.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18752921990.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp, MpCopyAccelerator.exe0.16.dr
Source: Binary string: WdNisDrv.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18739844648.0000016C079A3000.00000004.00000020.00020000.00000000.sdmp, mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpDlpCmd.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18560328758.0000016C07986000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18753508768.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpDlpCmd.exe.16.dr
Source: Binary string: MpDetours.pdb source: mpam-60574f34.exe, 00000010.00000003.18531267121.0000016C07983000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18753195690.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18761615816.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp, MpDetours.dll0.16.dr
Source: Binary string: WdDevFlt.pdb source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpSenseComm.pdb source: MpSigStub.exe, 00000013.00000003.18755428699.000001F8CDE4C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCommu.pdb source: MpSigStub.exe, 00000013.00000003.18752568256.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpDetoursCopyAccelerator.pdbGCTL source: MpSigStub.exe, 00000013.00000003.18761941166.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpAdlStub.pdbGCTL source: mpam-e428c3f6.exe, 00000003.00000000.18199651604.00007FF74E73F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: MpPayload.pdbGCTL source: mpengine.exe, 0000000C.00000002.18479667093.00007FF71C58B000.00000002.00000001.01000000.0000000D.sdmp, mpengine.exe, 0000000C.00000000.18476339200.00007FF71C58B000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: WdBoot.pdbGCTL source: mpam-60574f34.exe, 00000010.00000003.18737392209.0000016C07BA1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NisSrv.pdbGCTL source: NisSrv.exe.16.dr
Source: Binary string: MpDlpCmd.pdb source: mpam-60574f34.exe, 00000010.00000003.18560328758.0000016C07986000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18753508768.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp, MpDlpCmd.exe.16.dr
Source: Binary string: MsMpEng.pdb source: MpSigStub.exe, 00000013.00000003.18757615927.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpCopyAccelerator.pdb source: MpSigStub.exe, 00000013.00000003.18761414141.000001F8CDE42000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18752921990.000001F8CDE3B000.00000004.00000020.00020000.00000000.sdmp, MpCopyAccelerator.exe0.16.dr
Source: Binary string: MpClient.pdbGCTL source: MpSigStub.exe, 00000007.00000003.18393894759.000001DE0F544000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WaaSMedicSvc.pdb source: waasmedic.20220526_155057_892.etl.23.dr
Source: Binary string: MpUpdate.pdb source: MpSigStub.exe, 00000013.00000003.18756735348.000001F8CDE3D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MpPayload.pdb source: mpengine.exe, 0000000C.00000002.18479667093.00007FF71C58B000.00000002.00000001.01000000.0000000D.sdmp, mpengine.exe, 0000000C.00000000.18476339200.00007FF71C58B000.00000002.00000001.01000000.0000000D.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000001.00000002.18483403549.0000000002A10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.18323333088.0000000000F30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_6F3D30C0 push eax; ret 1_2_6F3D30EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A146B1 push ebp; retn C24Ch 1_2_02A1473F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A19BED push E3A3F1BDh; ret 1_2_02A19BF3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1377E push edx; iretd 1_2_02A137E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A21891 push edx; ret 1_2_02A21BE3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A168F4 push ds; iretd 1_2_02A168F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1BC6E push 85C0069Dh; ret 1_2_02A1BC74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A16561 push FFFFFF85h; retf 1_2_02A1658F
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Code function: 12_2_00007FF71C583084 pushfq ; retf 12_2_00007FF71C583218
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_6F3D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_6F3D1BFF
Binary contains a suspicious time stamp
Source: HPSUPD-Win32Exe.exe.1.dr Static PE information: 0x8CC4634B [Wed Nov 2 06:25:15 2044 UTC]
PE file contains sections with non-standard names
Source: vm3ddevapi64-debug.dll.1.dr Static PE information: section name: .didat
Source: vm3ddevapi64-debug.dll.1.dr Static PE information: section name: .gehcont
Source: vm3ddevapi64-debug.dll.1.dr Static PE information: section name: _RDATA
Source: lgpllibs.dll.1.dr Static PE information: section name: .00cfg
Source: WdBoot.sys.16.dr Static PE information: section name: GFIDS
Source: WdDevFlt.sys.16.dr Static PE information: section name: GFIDS
Source: WdFilter.sys.16.dr Static PE information: section name: GFIDS
Source: WdNisDrv.sys.16.dr Static PE information: section name: GFIDS
Source: MpClient.dll.16.dr Static PE information: section name: .didat
Source: MpCommu.dll.16.dr Static PE information: section name: .didat

Persistence and Installation Behavior
barindex
Sample is not signed and drops a device driver
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdBoot.sys Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdDevFlt.sys Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdFilter.sys Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdNisDrv.sys Jump to behavior
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpasbase.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpasdlta.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpavbase.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpavdlta.vdm Jump to dropped file
Drops PE files
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\cy-GB\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ar-SA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\id-ID\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\kn-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\af-ZA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-US\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-MX\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\bg-BG\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-FR\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sk-SK\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ml-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ta-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pl-PL\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\kk-KZ\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-US\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-TW\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pl-PL\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lo-LA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\en-US\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpasbase.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\uk-UA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\el-GR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ja-JP\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hi-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdFilter.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nb-NO\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sr-Cyrl-RS\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MsMpLics.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hu-HU\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ro-RO\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\bs-Latn-BA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sv-SE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-CA\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\da-DK\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\da-DK\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\gd-GB\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\it-IT\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\bn-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-PT\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ur-PK\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lt-LT\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-TW\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\he-IL\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ko-KR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File created: C:\Users\user\AppData\Local\Temp\nsd7AB8.tmp\System.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ru-RU\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpClient.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ne-NP\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File created: C:\Users\user\AppData\Local\Temp\lgpllibs.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File created: C:\Users\user\AppData\Local\Temp\HPSUPD-Win32Exe.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\th-TH\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\tr-TR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\vi-VN\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ProtectionManagement.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nl-NL\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hu-HU\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mk-MK\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mr-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSvc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nl-NL\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lb-LU\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpavdlta.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpEvMsg.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\endpointdlp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\cs-CZ\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\cs-CZ\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\tr-TR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hu-HU\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-TW\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCmdRun.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdNisDrv.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fil-PH\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpClient.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fa-IR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ko-KR\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sr-Cyrl-BA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\as-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MsMpEng.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-CN\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\el-GR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\tr-TR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-PT\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSenseComm.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\et-EE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-BR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File created: C:\Users\user\AppData\Local\Temp\vm3ddevapi64-debug.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\id-ID\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDetours.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpUpdate.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-ES\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpUxAgent.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\it-IT\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-GB\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\bg-BG\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ko-KR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nn-NO\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\gl-ES\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpOAV.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\de-DE\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-BR\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCommu.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\uk-UA\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nb-NO\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ar-SA\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sr-Latn-RS\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\th-TH\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lt-LT\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-FR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ru-RU\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\cs-CZ\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MsMpLics.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hr-HR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\da-DK\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sk-SK\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\is-IS\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\de-DE\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lv-LV\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ko-KR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-BR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-FR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\kok-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sr-Latn-RS\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-ES\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-FR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\DefenderCSP.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\az-Latn-AZ\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sv-SE\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pl-PL\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\de-DE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpasdlta.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpOAV.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-CN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-US\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hr-HR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\it-IT\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\tt-RU\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-TW\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-CA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ca-ES\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mpextms.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpCmdRun.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ja-JP\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\am-ET\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpAzSubmit.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-BR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ja-JP\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ca-ES-valencia\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fi-FI\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\de-DE\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fi-FI\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdDevFlt.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\te-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-CN\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ms-MY\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDlpCmd.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-MX\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sq-AL\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\gu-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\el-GR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-GB\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpDetours.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ru-RU\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ga-IE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ru-RU\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdBoot.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ro-RO\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-ES\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fi-FI\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpengine.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpAsDesc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\quz-PE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ca-ES\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-PT\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-CN\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\eu-ES\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-ES\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lv-LV\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\NisSrv.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\km-KH\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\he-IL\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mi-NZ\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sl-SI\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sl-SI\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sv-SE\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpRtp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\vi-VN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\endpointdlp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\it-IT\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ka-GE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mt-MT\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nl-NL\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpavbase.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ug-CN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-US\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\or-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ja-JP\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pa-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpAsDesc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nb-NO\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\et-EE\MpAsDesc.dll.mui Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\cy-GB\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ar-SA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\id-ID\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\kn-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\af-ZA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-US\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-MX\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\bg-BG\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-FR\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sk-SK\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ml-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ta-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pl-PL\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\kk-KZ\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-US\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-TW\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pl-PL\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lo-LA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\en-US\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpasbase.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\uk-UA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\el-GR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ja-JP\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hi-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdFilter.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nb-NO\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sr-Cyrl-RS\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MsMpLics.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hu-HU\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ro-RO\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\bs-Latn-BA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sv-SE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-CA\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\da-DK\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\da-DK\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\gd-GB\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\it-IT\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\bn-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-PT\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ur-PK\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lt-LT\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-TW\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\he-IL\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ko-KR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ru-RU\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpClient.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ne-NP\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\th-TH\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\tr-TR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\vi-VN\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ProtectionManagement.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nl-NL\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hu-HU\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mk-MK\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mr-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSvc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nl-NL\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lb-LU\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpavdlta.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpEvMsg.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\endpointdlp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\cs-CZ\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\cs-CZ\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\tr-TR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hu-HU\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-TW\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCmdRun.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdNisDrv.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fil-PH\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpClient.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fa-IR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ko-KR\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sr-Cyrl-BA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\as-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MsMpEng.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-CN\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\el-GR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\tr-TR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-PT\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSenseComm.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\et-EE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-BR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\id-ID\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDetours.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpUpdate.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-ES\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpUxAgent.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\it-IT\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-GB\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\bg-BG\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ko-KR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nn-NO\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\gl-ES\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpOAV.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\de-DE\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-BR\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCommu.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\uk-UA\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nb-NO\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ar-SA\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sr-Latn-RS\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\th-TH\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lt-LT\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-FR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ru-RU\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\cs-CZ\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MsMpLics.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hr-HR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\da-DK\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sk-SK\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\is-IS\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\de-DE\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lv-LV\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ko-KR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-BR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-FR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\kok-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sr-Latn-RS\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-ES\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-FR\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\DefenderCSP.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\az-Latn-AZ\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sv-SE\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pl-PL\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\de-DE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpasdlta.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpOAV.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-CN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-US\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\hr-HR\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\it-IT\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\tt-RU\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-TW\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fr-CA\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ca-ES\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mpextms.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpCmdRun.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ja-JP\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\am-ET\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpAzSubmit.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-BR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ja-JP\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ca-ES-valencia\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fi-FI\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\de-DE\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fi-FI\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdDevFlt.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\te-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-CN\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ms-MY\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDlpCmd.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-MX\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sq-AL\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\gu-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\el-GR\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-GB\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpDetours.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ru-RU\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ga-IE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ru-RU\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdBoot.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ro-RO\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-ES\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\fi-FI\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpengine.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpAsDesc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\quz-PE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ca-ES\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pt-PT\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\zh-CN\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\eu-ES\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\es-ES\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\lv-LV\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\NisSrv.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\km-KH\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\he-IL\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mi-NZ\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sl-SI\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sl-SI\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\sv-SE\MpAsDesc.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpRtp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\vi-VN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\endpointdlp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\it-IT\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ka-GE\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mt-MT\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nl-NL\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpavbase.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ug-CN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\en-US\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\or-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ja-JP\ProtectionManagement.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\pa-IN\mpuxagent.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpAsDesc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\nb-NO\MpEvMsg.dll.mui Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\et-EE\MpAsDesc.dll.mui Jump to dropped file
Creates or modifies windows services
Source: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EBBB10C2-099A-4A41-A364-F566D3127AB4}\MpKslDrv.sys Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpKsl1c70f6d2\Parameters\Wdf Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F447B0C8 OpenSCManagerW,OpenServiceW,CloseServiceHandle,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle, 7_2_00007FF6F447B0C8
Stores large binary data to the registry
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Key value created or modified: HKEY_USERSS-1-5-20\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363} DeviceTicket
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\NisSrv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\NisSrv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\NisSrv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\NisSrv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\NisSrv.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect Any.run
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483614717.0000000002B11000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483614717.0000000002B11000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 2040 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7928 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe TID: 8032 Thread sleep time: -30000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Window / User API: threadDelayed 9498 Jump to behavior
Found evasive API chain checking for process token information
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found dropped PE file which has not been started or loaded
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpAzSubmit.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpDetoursCopyAccelerator.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\lgpllibs.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vm3ddevapi64-debug.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdFilter.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\NisSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\HPSUPD-Win32Exe.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDetours.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpUpdate.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdDevFlt.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ProtectionManagement.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpUxAgent.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSvc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpRtp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDlpCmd.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\DefenderCSP.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\endpointdlp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MsMpEng.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpasdlta.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCommu.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpavdlta.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpEvMsg.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpDetours.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpavbase.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\endpointdlp.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdBoot.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpAsDesc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\mpextms.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpAsDesc.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpengine.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\x86\MpCmdRun.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\mpasbase.vdm Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSenseComm.dll Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpCmdRun.exe Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\Drivers\WdNisDrv.sys Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-60574f34.exe Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpDetoursCopyAccelerator.dll Jump to dropped file
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A106AA rdtsc 1_2_02A106AA
Contains functionality to enumerate device drivers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: LoadLibraryA,K32EnumDeviceDrivers, 1_2_02A26CC0
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe API call chain: ExitProcess graph end node
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: CompanyNameVMware, Inc.j!
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: http://www.vmware.com/0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483902290.00000000046D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: svchost.exe, 0000001D.00000002.23219682115.000002C16822A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllques
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: VMware, Inc.
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483902290.00000000046D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: VMware, Inc.1!0
Source: CasPol.exe, 00000005.00000002.23219964862.0000000001367000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWs
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483902290.00000000046D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: http://www.vmware.com/0/
Source: svchost.exe, 00000004.00000002.19521588046.000001602FC86000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.19518711686.000001602DE2A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23220195823.0000000001389000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000002.18817783819.000001F8CEA48000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: VMware, Inc.1
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: VMware, Inc.0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: ProductNameVMware SVGA 3D`
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483614717.0000000002B11000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dll
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483614717.0000000002B11000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483902290.00000000046D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: LegalCopyrightCopyright (C) 1998-2021 VMware, Inc.Z
Source: MpSigStub.exe, 00000013.00000003.18811101453.000001F8CDE5D000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000002.18816836580.000001F8CDE5D000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18809578323.000001F8CDE5D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`E
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483902290.00000000046D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: CasPol.exe, 00000005.00000002.23219609628.000000000132B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`#7
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: noreply@vmware.com0
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18481621853.000000000040A000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: FileDescriptionVMware SVGA 3D Device API Module:
Source: CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: mpam-60574f34.exe, 00000010.00000003.18544926204.0000016C07983000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: P]xMicrosoft HvVMwareVMware
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483902290.00000000046D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: mpam-60574f34.exe, 00000010.00000003.18544926204.0000016C07983000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: mpam-60574f34.exe, 00000010.00000003.18576459220.0000016C07988000.00000004.00000020.00020000.00000000.sdmp, MpSigStub.exe, 00000013.00000003.18758774396.000001F8CDE41000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [read : ToSubclass] boolean IsVirtualMachine = FALSE;
Source: mpam-60574f34.exe, 00000010.00000003.18516111834.0000016C07981000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <!-- DQYJKoZIhvcNAQEFBQACBQDl8FgVMCIYDzIwMjIwNDAxMDA0MDUzWhgPMjAyMjA0 -->
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483902290.00000000046D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe, 00000001.00000002.18483902290.00000000046D9000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: CasPol.exe, 00000005.00000002.23221722008.0000000002D89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-e428c3f6.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405C49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_00406873 FindFirstFileW,FindClose, 1_2_00406873
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_0040290B FindFirstFileW, 1_2_0040290B
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DADEC FindFirstFileW,FindNextFileW,FindClose,FindClose, 7_2_00007FF6F44DADEC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DB030 FindNextFileW,FindClose,FindFirstFileW, 7_2_00007FF6F44DB030
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F448F810 FindFirstFileW,FindNextFileW,FindClose,CloseHandle,CloseHandle, 7_2_00007FF6F448F810
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F4502504 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 7_2_00007FF6F4502504
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A1B030 FindNextFileW,FindClose,FindFirstFileW, 19_2_00007FF7D3A1B030
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A1ADEC FindFirstFileW,FindNextFileW,FindClose,FindClose, 19_2_00007FF7D3A1ADEC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A42504 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 19_2_00007FF7D3A42504
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D39CF810 FindFirstFileW,FindNextFileW,FindClose,CloseHandle,CloseHandle, 19_2_00007FF7D39CF810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe System information queried: ModuleInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_6F3D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_6F3D1BFF
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C2BD mov eax, dword ptr fs:[00000030h] 1_2_02A1C2BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C686 mov eax, dword ptr fs:[00000030h] 1_2_02A1C686
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C2DF mov eax, dword ptr fs:[00000030h] 1_2_02A1C2DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A2425B mov eax, dword ptr fs:[00000030h] 1_2_02A2425B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C387 mov eax, dword ptr fs:[00000030h] 1_2_02A1C387
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A257E5 mov eax, dword ptr fs:[00000030h] 1_2_02A257E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C3D4 mov eax, dword ptr fs:[00000030h] 1_2_02A1C3D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C4B7 mov ebx, dword ptr fs:[00000030h] 1_2_02A1C4B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C4B7 mov eax, dword ptr fs:[00000030h] 1_2_02A1C4B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C4D3 mov ebx, dword ptr fs:[00000030h] 1_2_02A1C4D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A1C438 mov eax, dword ptr fs:[00000030h] 1_2_02A1C438
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A2390B mov eax, dword ptr fs:[00000030h] 1_2_02A2390B
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44FBD68 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_00007FF6F44FBD68
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44F4A10 GetProcessHeap, 7_2_00007FF6F44F4A10
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_02A106AA rdtsc 1_2_02A106AA
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_205F5C20 LdrInitializeThunk, 5_2_205F5C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Memory allocated: page read and write | page guard Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44FB798 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 7_2_00007FF6F44FB798
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44FBD68 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_00007FF6F44FBD68
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44FBF4C SetUnhandledExceptionFilter, 7_2_00007FF6F44FBF4C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44E3BFC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 7_2_00007FF6F44E3BFC
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Code function: 12_2_00007FF71C589808 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_00007FF71C589808
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Code function: 12_2_00007FF71C589C54 SetUnhandledExceptionFilter, 12_2_00007FF71C589C54
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe Code function: 12_2_00007FF71C589AAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_00007FF71C589AAC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A3B798 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 19_2_00007FF7D3A3B798
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A23BFC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 19_2_00007FF7D3A23BFC
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A3BF4C SetUnhandledExceptionFilter, 19_2_00007FF7D3A3BF4C
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\724B5320-FE6C-430F-AB77-13F2FD7207BA\MpSigStub.exe Code function: 19_2_00007FF7D3A3BD68 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 19_2_00007FF7D3A3BD68

HIPS / PFW / Operating System Protection Evasion
barindex
DLL side loading technique detected
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\X86\MpOAV.dll Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: F30000 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\wevtutil.exe C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\TEMP\3FCB5F68-CD33-FF2F-34AE-798C9A7026D4.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe" Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DE0C4 AllocateAndInitializeSid,FreeSid, 7_2_00007FF6F44DE0C4
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44DF884 GetCurrentProcess,GetLengthSid,InitializeSecurityDescriptor,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,GetLastError,CloseHandle,SetLastError, 7_2_00007FF6F44DF884
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44D418C cpuid 7_2_00007FF6F44D418C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F44808C8 GetSystemTime,GetDateFormatW,GetTimeFormatW,GetCurrentProcessId, 7_2_00007FF6F44808C8
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\2C39E2B2-9640-4516-B068-8044B49E3F95\MpSigStub.exe Code function: 7_2_00007FF6F448F3E8 GetCurrentProcessId,GetCurrentProcessId,CreateNamedPipeW,GetCurrentProcessId, 7_2_00007FF6F448F3E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe Code function: 1_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_0040352D
AV process strings found (often used to terminate AV products)
Source: mpam-60574f34.exe Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 3872, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 3872, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000005.00000002.23244260810.000000001D881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 3872, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 634670 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 26/05/2022 Architecture: WINDOWS Score: 100 64 Found malware configuration 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 Yara detected GuLoader 2->68 70 4 other signatures 2->70 7 mpam-60574f34.exe 354 2->7         started        11 SecuriteInfo.com.Trojan.Siggen17.57062.9420.exe 4 37 2->11         started        13 mpam-e428c3f6.exe 7 2->13         started        15 10 other processes 2->15 process3 dnsIp4 34 C:\Windows\...\mpuxagent.dll.mui, PE32 7->34 dropped 36 C:\Windows\...\ProtectionManagement.dll.mui, PE32 7->36 dropped 38 C:\Windows\...\MpEvMsg.dll.mui, PE32 7->38 dropped 46 194 other files (none is malicious) 7->46 dropped 80 Sample is not signed and drops a device driver 7->80 18 MpSigStub.exe 7->18         started        48 4 other files (none is malicious) 11->48 dropped 82 Writes to foreign memory regions 11->82 84 Tries to detect Any.run 11->84 21 CasPol.exe 11 11->21         started        40 C:\Windows\ServiceProfiles\...\mpengine.dll, PE32+ 13->40 dropped 42 C:\Windows\ServiceProfiles\...\mpavdlta.vdm, PE32+ 13->42 dropped 44 C:\Windows\ServiceProfiles\...\mpavbase.vdm, PE32+ 13->44 dropped 50 3 other files (none is malicious) 13->50 dropped 24 MpSigStub.exe 1 13->24         started        60 127.0.0.1 unknown unknown 15->60 62 192.168.11.1 unknown unknown 15->62 26 conhost.exe 15->26         started        28 conhost.exe 15->28         started        30 conhost.exe 15->30         started        file5 signatures6 process7 dnsIp8 52 20.189.173.22 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->52 54 209.197.3.8 HIGHWINDS3US United States 21->54 56 142.251.37.97 GOOGLEUS United States 21->56 58 2 other IPs or domains 21->58 72 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->72 74 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 21->74 76 Tries to steal Mail credentials (via file / registry access) 21->76 78 5 other signatures 21->78 32 conhost.exe 21->32         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.217.23.110
 unknown United States
15169 GOOGLEUS false
94.46.30.74
 unknown Portugal
24768 ALMOUROLTECPT false
142.251.37.97
 unknown United States
15169 GOOGLEUS false
209.197.3.8
 unknown United States
20446 HIGHWINDS3US false
20.189.173.22
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Private

IP
192.168.11.1
127.0.0.1