Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 7, 2021, 11:31 a.m.	May 7, 2021, 11:42 a.m.

Size	3.2MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`5f1de1b48258ba6f813ceda56967aa7c`
SHA256	`31ad90e0b83c3bf244b444db9d598914719a78734a7eacad39624709392660c4`
CRC32	`5C0DB826`
ssdeep	`768:oTehk2CmTlnHglPBPfMkFblKDgSlcEIESwmQBOk+StG62a8xfTaupYfJg2EABjyQ:oTZ4`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

o2.exe "C:\Users\test22\AppData\Local\Temp\o2.exe"
2648
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force
  2264
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force
  2744
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force
  1452
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force
  2112
- 3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe"
  2540
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force
    2236
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force
    3052
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force
    3084
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force
    3180
  - 3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe"
    3652
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force
  852
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force
  1908
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force
  2480

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 70 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 7, 2021, 11:31 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (17 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:31 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:32 a.m.			0	0
IsDebuggerPresent May 7, 2021, 11:32 a.m.			0	0

Command line console output was observed (50 out of 103 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\o2.e console_handle: 0x00000053	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: xe -Force console_handle: 0x0000005f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\Microso console_handle: 0x00000053	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: ft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522 console_handle: 0x0000005f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: j8WH0e.exe -Force console_handle: 0x0000006b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x00000077	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: mmandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000008f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\Microso console_handle: 0x00000053	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: ft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522 console_handle: 0x0000005f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: j8WH0e.exe -Force console_handle: 0x0000006b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x00000077	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: mmandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x0000008f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\o2.e console_handle: 0x00000053	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: xe -Force console_handle: 0x0000005f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Windows\Resources\Themes\aero\Shell\ console_handle: 0x00000053	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 7, 2021, 11:31 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 515 events)

Time & API	Arguments	Status	Return
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x009d6318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x009d6418 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x009d6418 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cb58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cc18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065cfd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065d7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 7, 2021, 11:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a7ab8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 7, 2021, 11:31 a.m.		1	1	0

One or more processes crashed (10 events)

Time & API	Arguments	Status
__exception__ May 7, 2021, 11:31 a.m.	stacktrace: 0xa81426 0xa80be9 0xa80779 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x72460c17 microsoft+0x3f33f @ 0x7244f33f microsoft+0x3edf8 @ 0x7244edf8 microsoft+0x3e3b9 @ 0x7244e3b9 microsoft+0x17e980 @ 0x7258e980 0xa80743 0xa800a8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 4a 9c 43 6f c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa81493 registers.esp: 6414164 registers.edi: 6414184 registers.eax: 0 registers.ebp: 6414196 registers.edx: 40768040 registers.ebx: 6414496 registers.esi: 40768040 registers.ecx: 0	1
__exception__ May 7, 2021, 11:31 a.m.	stacktrace: 0xa81438 0xa80be9 0xa80779 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x72460c17 microsoft+0x3f33f @ 0x7244f33f microsoft+0x3edf8 @ 0x7244edf8 microsoft+0x3e3b9 @ 0x7244e3b9 microsoft+0x17e980 @ 0x7258e980 0xa80743 0xa800a8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 4a 9c 43 6f c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa81493 registers.esp: 6414164 registers.edi: 6414184 registers.eax: 0 registers.ebp: 6414196 registers.edx: 51502108 registers.ebx: 6414496 registers.esi: 51502108 registers.ecx: 0	1
__exception__ May 7, 2021, 11:31 a.m.	stacktrace: 0x5a1426 0x5a0be9 0x5a0779 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x72460c17 microsoft+0x3f33f @ 0x7244f33f microsoft+0x3edf8 @ 0x7244edf8 microsoft+0x3e3b9 @ 0x7244e3b9 microsoft+0x17e980 @ 0x7258e980 0x5a0743 0x5a00a8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 4a 9c 91 6f c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5a1493 registers.esp: 3857828 registers.edi: 3857848 registers.eax: 0 registers.ebp: 3857860 registers.edx: 42013224 registers.ebx: 3858160 registers.esi: 42013224 registers.ecx: 0	1
__exception__ May 7, 2021, 11:31 a.m.	stacktrace: 0x5a1438 0x5a0be9 0x5a0779 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x72460c17 microsoft+0x3f33f @ 0x7244f33f microsoft+0x3edf8 @ 0x7244edf8 microsoft+0x3e3b9 @ 0x7244e3b9 microsoft+0x17e980 @ 0x7258e980 0x5a0743 0x5a00a8 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 4a 9c 91 6f c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5a1493 registers.esp: 3857828 registers.edi: 3857848 registers.eax: 0 registers.ebp: 3857860 registers.edx: 52739800 registers.ebx: 3858160 registers.esi: 52739800 registers.ecx: 0	1
__exception__ May 7, 2021, 11:32 a.m.	stacktrace: 0x531718 0x530f3b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 0b d8 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x531b8b registers.esp: 3599920 registers.edi: 3599944 registers.eax: 0 registers.ebp: 3599956 registers.edx: 195 registers.ebx: 3600204 registers.esi: 44057908 registers.ecx: 0	1
__exception__ May 7, 2021, 11:33 a.m.	stacktrace: 0x536f94 0x5314a9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 38 07 68 ff ff ff 7f 6a 00 8b cf e8 a2 14 9f 6f exception.instruction: cmp byte ptr [edi], al exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x53d81e registers.esp: 3598652 registers.edi: 0 registers.eax: 44344732 registers.ebp: 3598700 registers.edx: 44344732 registers.ebx: 44344176 registers.esi: 44344152 registers.ecx: 1875134866	1
__exception__ May 7, 2021, 11:33 a.m.	stacktrace: 0x5371c9 0x5314a9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 36 fc f7 6e 83 78 04 00 0f 84 3c 02 00 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf30eaf registers.esp: 3598620 registers.edi: 3598684 registers.eax: 0 registers.ebp: 3598700 registers.edx: 3598588 registers.ebx: 44208340 registers.esi: 44210488 registers.ecx: 0	1
__exception__ May 7, 2021, 11:33 a.m.	stacktrace: 0x5379b6 0x5314a9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 21 34 f7 6e 89 45 c8 33 d2 89 55 dc 83 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf3d6c4 registers.esp: 3598636 registers.edi: 3598684 registers.eax: 0 registers.ebp: 3598700 registers.edx: 3598604 registers.ebx: 44208340 registers.esi: 44210488 registers.ecx: 0	1
__exception__ May 7, 2021, 11:33 a.m.	stacktrace: 0x537a76 0x5314a9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 2c ff 50 14 38 00 89 45 cc e9 85 00 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf3dcb9 registers.esp: 3598648 registers.edi: 3598688 registers.eax: 3 registers.ebp: 3598700 registers.edx: 0 registers.ebx: 44208340 registers.esi: 44727572 registers.ecx: 0	1
__exception__ May 7, 2021, 11:33 a.m.	stacktrace: 0x5314a9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 83 78 04 01 0f 9f c0 0f b6 c0 83 7f 04 01 0f 9f exception.instruction: cmp dword ptr [eax + 4], 1 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x537b8a registers.esp: 3598708 registers.edi: 44738136 registers.eax: 0 registers.ebp: 3599992 registers.edx: 44738136 registers.ebx: 0 registers.esi: 0 registers.ecx: 43525444	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1622 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00722000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00755000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00757000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00747000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00746000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a85000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02720000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d8d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d8d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02752000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02762000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0278a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02763000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02764000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0275b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02782000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02765000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0278c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 7, 2021, 11:31 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02766000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force

A process created a hidden window (11 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 7, 2021, 11:31 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force filepath: powershell	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (13 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 7, 2021, 11:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 7, 2021, 11:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (10 events)

description	Communications smtp	rule	Network_SMTP_dotNet
description	Run a KeyLogger	rule	KeyLogger
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Terminates another process (12 events)

Time & API	Arguments	Status
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3548 process_handle: 0x0000043c
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3548 process_handle: 0x0000043c	1
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3584 process_handle: 0x00000444
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3584 process_handle: 0x00000444	1
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3620 process_handle: 0x0000044c
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3620 process_handle: 0x0000044c	1
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3692 process_handle: 0x00000454
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3692 process_handle: 0x00000454	1
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3728 process_handle: 0x0000045c
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 3728 process_handle: 0x0000045c	1
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 2540 process_handle: 0x00000238
NtTerminateProcess May 7, 2021, 11:32 a.m.	status_code: 0xffffffff process_identifier: 2540 process_handle: 0x00000238	1

Allocates execute permission to another process indicative of possible code injection (6 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3548 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000434		3221225496
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3584 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000438		3221225496
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3620 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000440		3221225496
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3692 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000448		3221225496
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3728 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450		3221225496
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3652 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c8	1	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 7, 2021, 11:32 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe tried to sleep 13641050 seconds, actually delayed analysis time by 13641050 seconds

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e	reg_value	C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e	reg_value	C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\qweruiuyt	reg_value	C:\Users\test22\AppData\Local\Temp\qweruiuyt\qweruiuyt.exe

Harvests credentials from local FTP client softwares (5 events)

file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
registry	HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 2648 manipulating memory of non-child process 3548
Process injection	Process 2648 manipulating memory of non-child process 3584
Process injection	Process 2648 manipulating memory of non-child process 3620
Process injection	Process 2648 manipulating memory of non-child process 3692
Process injection	Process 2648 manipulating memory of non-child process 3728
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3548 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000434	3221225496	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3584 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000438	3221225496	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3620 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000440	3221225496	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3692 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000448	3221225496	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3728 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450	3221225496	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory May 7, 2021, 11:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELB¡`àX^v @ À@vSD H.textdV X `.rsrcDZ@@.reloc l@B base_address: 0x00400000 process_identifier: 3652 process_handle: 0x000003c8	1	1
WriteProcessMemory May 7, 2021, 11:32 a.m.	buffer: p`6 base_address: 0x0043a000 process_identifier: 3652 process_handle: 0x000003c8	1	1
WriteProcessMemory May 7, 2021, 11:32 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 3652 process_handle: 0x000003c8	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 7, 2021, 11:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELB¡`àX^v @ À@vSD H.textdV X `.rsrcDZ@@.reloc l@B base_address: 0x00400000 process_identifier: 3652 process_handle: 0x000003c8	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW May 7, 2021, 11:33 a.m.	thread_identifier: 0 callback_function: 0x00c513ea hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	459591	0

Harvests credentials from local email clients (5 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2540 called NtSetContextThread to modify thread in remote process 3652
NtSetContextThread May 7, 2021, 11:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4421214 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003c0 process_identifier: 3652	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\qweruiuyt\qweruiuyt.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2540 resumed a thread in remote process 3652
NtResumeThread May 7, 2021, 11:32 a.m.	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 3652	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe

Disables Windows Security features (1 event)

description

attempts to disable user access control

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.5f1de1b48258ba6f
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.81040a
BitDefenderTheta	Gen:NN.ZemsilF.34688.np0@ayfrUWk
Cyren	W32/MSIL_Agent.BYJ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.FEYU
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
Paloalto	generic.ml
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.wz
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_90%
Cynet	Malicious (score: 100)
Malwarebytes	Trojan.Crypt
Ikarus	Trojan.Fsysna
Fortinet	MSIL/GenKryptik.FEYU!tr
CrowdStrike	win/malicious_confidence_90% (D)

Executed a process and injected code into it, probably while unpacking (50 out of 113 events)

Time & API	Arguments	Status	Return
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2648	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2648	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2648	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 2648	1	0
NtGetContextThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2648	1	0
NtGetContextThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2648	1	0
NtGetContextThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2648	1	0
CreateProcessInternalW May 7, 2021, 11:31 a.m.	thread_identifier: 2800 thread_handle: 0x0000036c process_identifier: 2264 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000374	1	1
CreateProcessInternalW May 7, 2021, 11:31 a.m.	thread_identifier: 2084 thread_handle: 0x00000348 process_identifier: 2744 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000374	1	1
CreateProcessInternalW May 7, 2021, 11:31 a.m.	thread_identifier: 1812 thread_handle: 0x00000344 process_identifier: 1452 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000378	1	1
CreateProcessInternalW May 7, 2021, 11:31 a.m.	thread_identifier: 1808 thread_handle: 0x0000031c process_identifier: 2112 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000036c	1	1
CreateProcessInternalW May 7, 2021, 11:31 a.m.	thread_identifier: 2492 thread_handle: 0x000003b4 process_identifier: 2540 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3CaGsd8r9OF4xaYa15Bod8z53Aer818BVZ363522j8WH0e.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d8	1	1
CreateProcessInternalW May 7, 2021, 11:31 a.m.	thread_identifier: 1436 thread_handle: 0x000003c8 process_identifier: 852 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e8	1	1
CreateProcessInternalW May 7, 2021, 11:31 a.m.	thread_identifier: 2972 thread_handle: 0x000003d4 process_identifier: 1908 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\o2.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e4	1	1
CreateProcessInternalW May 7, 2021, 11:31 a.m.	thread_identifier: 2672 thread_handle: 0x000003b4 process_identifier: 2480 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\S3s68fjC5bl7cSn43bm28y4AWVt8ckcR3bH6Z2x7a5F89a\svchost.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e8	1	1
CreateProcessInternalW May 7, 2021, 11:32 a.m.	thread_identifier: 3552 thread_handle: 0x0000042c process_identifier: 3548 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\o2.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\o2.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000434	1	1
NtGetContextThread May 7, 2021, 11:32 a.m.	thread_handle: 0x0000042c	1	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3548 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000434		3221225496
CreateProcessInternalW May 7, 2021, 11:32 a.m.	thread_identifier: 3588 thread_handle: 0x0000043c process_identifier: 3584 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\o2.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\o2.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000438	1	1
NtGetContextThread May 7, 2021, 11:32 a.m.	thread_handle: 0x0000043c	1	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3584 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000438		3221225496
CreateProcessInternalW May 7, 2021, 11:32 a.m.	thread_identifier: 3624 thread_handle: 0x00000444 process_identifier: 3620 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\o2.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\o2.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000440	1	1
NtGetContextThread May 7, 2021, 11:32 a.m.	thread_handle: 0x00000444	1	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3620 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000440		3221225496
CreateProcessInternalW May 7, 2021, 11:32 a.m.	thread_identifier: 3696 thread_handle: 0x0000044c process_identifier: 3692 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\o2.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\o2.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000448	1	1
NtGetContextThread May 7, 2021, 11:32 a.m.	thread_handle: 0x0000044c	1	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3692 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000448		3221225496
CreateProcessInternalW May 7, 2021, 11:32 a.m.	thread_identifier: 3732 thread_handle: 0x00000454 process_identifier: 3728 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\o2.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\o2.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000450	1	1
NtGetContextThread May 7, 2021, 11:32 a.m.	thread_handle: 0x00000454	1	0
NtAllocateVirtualMemory May 7, 2021, 11:32 a.m.	process_identifier: 3728 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450		3221225496
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x00000458 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000004b8 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2744	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2744	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2744	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2744	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 1452	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 1452	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x0000045c suspend_count: 1 process_identifier: 1452	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000004bc suspend_count: 1 process_identifier: 1452	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2112	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2112	1	0
NtResumeThread May 7, 2021, 11:31 a.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2112	1	0

o2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All