Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 31, 2021, 9:16 a.m.	May 31, 2021, 9:34 a.m.

Size	5.7MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`54262706e573614d224fec09edb4f7cf`
SHA256	`7d3694db8e536f04226a3c39afba735c51abbccc63a2ac466b65245d2ae3fe4a`
CRC32	`E3F47689`
ssdeep	`3072:qW1N+cU/Lj+lMEDQmUyzbnVzkd1oPbb3G5MkaVE+WAb41ow1IILQDpgritdMksHY:V`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

jaja.exe "C:\Users\test22\AppData\Local\Temp\jaja.exe"
1016
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force
  2264
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force
  2744
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force
  2760
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force
  2696
- 0b1DbdV84ybhd1.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe"
  2764
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force
    2892
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force
    1852
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force
    2720
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force
    604
  - 0b1DbdV84ybhd1.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe"
    3292
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force
  1940
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force
  1420
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force
  2480

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 70 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2021, 9:16 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (17 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:16 a.m.			0	0

Command line console output was observed (50 out of 99 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\jaja console_handle: 0x00000053	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: .exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\Microso console_handle: 0x00000053	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: ft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\Microso console_handle: 0x00000053	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: ft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\jaja console_handle: 0x00000053	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: .exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Windows\Microsoft.NET\Framework\Ndy5 console_handle: 0x00000053	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 31, 2021, 9:16 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\jaja console_handle: 0x00000053	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 515 events)

Time & API	Arguments	Status	Return
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020a628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020aaa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020aaa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020b630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020b6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020b6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020b6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020b6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020b6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020b6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020bab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020bab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020bab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020bd30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0020c2b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2021, 9:16 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003abf60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 31, 2021, 9:16 a.m.		1	1	0

One or more processes crashed (10 events)

Time & API	Arguments	Status
__exception__ May 31, 2021, 9:16 a.m.	stacktrace: 0x23d1416 0x23d0bd9 0x23d0769 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 microsoft+0x1069af @ 0x725169af microsoft+0x10261c @ 0x7251261c microsoft+0x14b2d0 @ 0x7255b2d0 0x23d0742 0x23d06a6 0x23d0279 0x23d0076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 5a 9c ae 6d c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x23d1483 registers.esp: 11001876 registers.edi: 11001896 registers.eax: 0 registers.ebp: 11001908 registers.edx: 39916072 registers.ebx: 11002208 registers.esi: 39916072 registers.ecx: 0	1
__exception__ May 31, 2021, 9:16 a.m.	stacktrace: 0x23d1428 0x23d0bd9 0x23d0769 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 microsoft+0x1069af @ 0x725169af microsoft+0x10261c @ 0x7251261c microsoft+0x14b2d0 @ 0x7255b2d0 0x23d0742 0x23d06a6 0x23d0279 0x23d0076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 5a 9c ae 6d c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x23d1483 registers.esp: 11001876 registers.edi: 11001896 registers.eax: 0 registers.ebp: 11001908 registers.edx: 128323032 registers.ebx: 11002208 registers.esi: 128323032 registers.ecx: 0	1
__exception__ May 31, 2021, 9:16 a.m.	stacktrace: 0x691416 0x690bd9 0x690769 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 microsoft+0x1069af @ 0x725169af microsoft+0x10261c @ 0x7251261c microsoft+0x14b2d0 @ 0x7255b2d0 0x690742 0x6906a6 0x690279 0x690076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 5a 9c 82 6f c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x691483 registers.esp: 3792244 registers.edi: 3792264 registers.eax: 0 registers.ebp: 3792276 registers.edx: 41751080 registers.ebx: 3792576 registers.esi: 41751080 registers.ecx: 0	1
__exception__ May 31, 2021, 9:16 a.m.	stacktrace: 0x691428 0x690bd9 0x690769 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7279bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7279bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x7275cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x7275cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x72848841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x727c14e9 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 microsoft+0x1069af @ 0x725169af microsoft+0x10261c @ 0x7251261c microsoft+0x14b2d0 @ 0x7255b2d0 0x690742 0x6906a6 0x690279 0x690076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 5a 9c 82 6f c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x691483 registers.esp: 3792244 registers.edi: 3792264 registers.eax: 0 registers.ebp: 3792276 registers.edx: 146836636 registers.ebx: 3792576 registers.esi: 146836636 registers.ecx: 0	1
__exception__ May 31, 2021, 9:16 a.m.	stacktrace: 0x5a1798 0x5a0fbb DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 8b d7 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5a1c0b registers.esp: 3142288 registers.edi: 3142312 registers.eax: 0 registers.ebp: 3142324 registers.edx: 195 registers.ebx: 3142572 registers.esi: 44814240 registers.ecx: 0	1
__exception__ May 31, 2021, 9:17 a.m.	stacktrace: 0x5a6f23 0x5a1529 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 c6 d9 c9 6a 83 78 04 00 0f 84 3c 02 00 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x521311f registers.esp: 3140996 registers.edi: 3141060 registers.eax: 0 registers.ebp: 3141076 registers.edx: 3140964 registers.ebx: 44988840 registers.esi: 44990988 registers.ecx: 0	1
__exception__ May 31, 2021, 9:17 a.m.	stacktrace: 0x5a6f7e 0x5a1529 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 c1 d6 c9 6a 89 45 c8 33 d2 89 55 dc 83 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5213424 registers.esp: 3141012 registers.edi: 3141060 registers.eax: 0 registers.ebp: 3141076 registers.edx: 3140980 registers.ebx: 44988840 registers.esi: 44990988 registers.ecx: 0	1
__exception__ May 31, 2021, 9:17 a.m.	stacktrace: 0x5a74d0 0x5a1529 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 2c ff 50 14 38 00 89 45 cc e9 85 00 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x52196c1 registers.esp: 3141024 registers.edi: 3141064 registers.eax: 3 registers.ebp: 3141076 registers.edx: 0 registers.ebx: 44988840 registers.esi: 45374032 registers.ecx: 0	1
__exception__ May 31, 2021, 9:17 a.m.	stacktrace: 0x5a1529 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 83 78 04 01 0f 9f c0 0f b6 c0 83 7f 04 01 0f 9f exception.instruction: cmp dword ptr [eax + 4], 1 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5a75e4 registers.esp: 3141084 registers.edi: 45384596 registers.eax: 0 registers.ebp: 3142360 registers.edx: 45384596 registers.ebx: 0 registers.esi: 0 registers.ecx: 44311620	1
__exception__ May 31, 2021, 9:17 a.m.	stacktrace: 0x5a7c3b 0x5a1529 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 38 07 68 ff ff ff 7f 6a 00 8b cf e8 e2 16 d1 6a exception.instruction: cmp byte ptr [edi], al exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x521d5de registers.esp: 3141028 registers.edi: 0 registers.eax: 45481092 registers.ebp: 3141076 registers.edx: 45481092 registers.ebx: 45480536 registers.esi: 45480512 registers.ecx: 1875134866	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1622 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cf5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cfb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cf7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c7a1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c7a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0280a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0281b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02817000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02802000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02815000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0280c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force

A process created a hidden window (11 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force filepath: powershell	1	1
ShellExecuteExW May 31, 2021, 9:16 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force filepath: powershell	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (13 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 31, 2021, 9:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (10 events)

description	Communications smtp	rule	Network_SMTP_dotNet
description	Run a KeyLogger	rule	KeyLogger
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Terminates another process (12 events)

Time & API	Arguments	Status
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3184 process_handle: 0x00000444
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3184 process_handle: 0x00000444	1
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3220 process_handle: 0x0000044c
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3220 process_handle: 0x0000044c	1
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3256 process_handle: 0x00000454
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3256 process_handle: 0x00000454	1
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3328 process_handle: 0x0000045c
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3328 process_handle: 0x0000045c	1
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3364 process_handle: 0x00000464
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 3364 process_handle: 0x00000464	1
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 2764 process_handle: 0x00000234
NtTerminateProcess May 31, 2021, 9:16 a.m.	status_code: 0xffffffff process_identifier: 2764 process_handle: 0x00000234	1

Allocates execute permission to another process indicative of possible code injection (6 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3184 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000043c		3221225496
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3220 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000440		3221225496
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3256 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000448		3221225496
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3328 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450		3221225496
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3364 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000458		3221225496
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3292 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003d4	1	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 31, 2021, 9:16 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

0b1DbdV84ybhd1.exe tried to sleep 13641050 seconds, actually delayed analysis time by 13641050 seconds

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\0b1DbdV84ybhd1	reg_value	C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\0b1DbdV84ybhd1	reg_value	C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\qweruiuyt	reg_value	C:\Users\test22\AppData\Local\Temp\qweruiuyt\qweruiuyt.exe

Harvests credentials from local FTP client softwares (5 events)

file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
registry	HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1016 manipulating memory of non-child process 3184
Process injection	Process 1016 manipulating memory of non-child process 3220
Process injection	Process 1016 manipulating memory of non-child process 3256
Process injection	Process 1016 manipulating memory of non-child process 3328
Process injection	Process 1016 manipulating memory of non-child process 3364
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3184 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000043c	3221225496	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3220 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000440	3221225496	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3256 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000448	3221225496	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3328 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450	3221225496	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3364 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000458	3221225496	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory May 31, 2021, 9:16 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELhI°`àX®nw @ ` @wWÌª@ H.texttW X `.rsrcÌª¬Z@@.reloc@ @B base_address: 0x00400000 process_identifier: 3292 process_handle: 0x000003d4	1	1
WriteProcessMemory May 31, 2021, 9:16 a.m.	buffer: pp7 base_address: 0x00494000 process_identifier: 3292 process_handle: 0x000003d4	1	1
WriteProcessMemory May 31, 2021, 9:16 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 3292 process_handle: 0x000003d4	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 31, 2021, 9:16 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELhI°`àX®nw @ ` @wWÌª@ H.texttW X `.rsrcÌª¬Z@@.reloc@ @B base_address: 0x00400000 process_identifier: 3292 process_handle: 0x000003d4	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW May 31, 2021, 9:17 a.m.	thread_identifier: 0 callback_function: 0x005413ea hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	459591	0

Harvests credentials from local email clients (5 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2764 called NtSetContextThread to modify thread in remote process 3292
NtSetContextThread May 31, 2021, 9:16 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4421486 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003cc process_identifier: 3292	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\qweruiuyt\qweruiuyt.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2764 resumed a thread in remote process 3292
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000003cc suspend_count: 1 process_identifier: 3292	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe

Disables Windows Security features (1 event)

description

attempts to disable user access control

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

Executed a process and injected code into it, probably while unpacking (50 out of 109 events)

Time & API	Arguments	Status	Return
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 1016	1	0
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1016	1	0
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1016	1	0
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1016	1	0
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 2800 thread_handle: 0x00000378 process_identifier: 2264 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000380	1	1
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 2624 thread_handle: 0x00000350 process_identifier: 2744 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000380	1	1
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 1452 thread_handle: 0x00000330 process_identifier: 2760 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000384	1	1
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 1120 thread_handle: 0x00000328 process_identifier: 2696 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000378	1	1
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 3020 thread_handle: 0x000003c0 process_identifier: 2764 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0b1DbdV84ybhd1.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e4	1	1
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 1436 thread_handle: 0x000003cc process_identifier: 1940 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003f4	1	1
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 2448 thread_handle: 0x000003c0 process_identifier: 1420 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\jaja.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003f0	1	1
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 1304 thread_handle: 0x000003ec process_identifier: 2480 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ndy5dd60Cfvdb9kb097f1b0JHT356f3u145Ea3c4d40A\svchost.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003f4	1	1
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 3188 thread_handle: 0x00000434 process_identifier: 3184 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\jaja.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\jaja.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000043c	1	1
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000434	1	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3184 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000043c		3221225496
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 3224 thread_handle: 0x00000444 process_identifier: 3220 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\jaja.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\jaja.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000440	1	1
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000444	1	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3220 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000440		3221225496
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 3260 thread_handle: 0x0000044c process_identifier: 3256 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\jaja.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\jaja.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000448	1	1
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x0000044c	1	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3256 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000448		3221225496
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 3332 thread_handle: 0x00000454 process_identifier: 3328 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\jaja.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\jaja.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000450	1	1
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000454	1	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3328 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450		3221225496
CreateProcessInternalW May 31, 2021, 9:16 a.m.	thread_identifier: 3368 thread_handle: 0x0000045c process_identifier: 3364 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\jaja.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\jaja.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000458	1	1
NtGetContextThread May 31, 2021, 9:16 a.m.	thread_handle: 0x0000045c	1	0
NtAllocateVirtualMemory May 31, 2021, 9:16 a.m.	process_identifier: 3364 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000458		3221225496
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000004b4 suspend_count: 1 process_identifier: 2264	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2744	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2744	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2744	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2744	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2696	1	0
NtResumeThread May 31, 2021, 9:16 a.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2696	1	0

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.MSILHeracles.16500
FireEye	Generic.mg.54262706e573614d
CAT-QuickHeal	Program.Wacapew
McAfee	PWS-FCYX!54262706E573
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Kryptik.ali2000016
K7GW	Trojan ( 0057d2b31 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.MSILHeracles.D4074
Cyren	W32/MSIL_Kryptik.EKB.gen!Eldorado
Symantec	Trojan Horse
ESET-NOD32	a variant of MSIL/Kryptik.ABDX
APEX	Malicious
Avast	FileRepMalware
Kaspersky	HEUR:Trojan.MSIL.PowerShell.gen
BitDefender	Gen:Variant.MSILHeracles.16500
Paloalto	generic.ml
Ad-Aware	Gen:Variant.MSILHeracles.16500
Sophos	Mal/Generic-S
Comodo	Malware@#3ej87bxwbgt8f
DrWeb	Trojan.PackedNET.772
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.tz
Emsisoft	Gen:Variant.MSILHeracles.16500 (B)
Ikarus	Trojan.Inject
Avira	TR/AD.AgentTesla.slanw
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win32.Packed.oa
Microsoft	Trojan:Win32/AgentTesla!ml
AegisLab	Trojan.Win32.Heracles.4!c
GData	Gen:Variant.MSILHeracles.16500
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4498596
ALYac	Gen:Variant.MSILHeracles.16500
MAX	malware (ai score=99)
Malwarebytes	Trojan.MalPack.MSIL
TrendMicro-HouseCall	TROJ_GEN.R002H0CET21
Rising	Trojan.Kryptik!8.8 (CLOUD)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	MSIL/Kryptik.ABDX!tr
BitDefenderTheta	Gen:NN.ZemsilF.34692.@p0@a4QZv@ji
AVG	FileRepMalware
Cybereason	malicious.4dfd60
Panda	Trj/CI.A

jaja.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All