Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 9, 2021, 9:48 a.m.	June 9, 2021, 9:53 a.m.

Size	6.0MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`20f307c716a689f4afa3a76b7143db22`
SHA256	`3647e2dc4336b2eeb828371821c706a329dce645cb16f9c1c31c3faeae8f56dd`
CRC32	`0214AE63`
ssdeep	`49152:gJZm5w1U7yC5Y59whp6IRNCjm78jBtrUQWT6726n4lMZLr5jJTMVmiKpN+UL7Jmw:gG5w1Cyh`
Yara	NPKI_Zero - File included NPKI PE_Header_Zero - PE File Signature IsPE64 - (no description)

al.exe "C:\Users\test22\AppData\Local\Temp\al.exe"
7528
- powershell.exe "powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1'
  2120
  - csc.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\1sxnmgiv.cmdline"
    4004
    - cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESE77.tmp" "c:\Users\test22\AppData\Local\Temp\CSCE18.tmp"
      3180
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
    8004

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 9, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 9, 2021, 9:48 a.m.			0	0
IsDebuggerPresent June 9, 2021, 9:48 a.m.			0	0
IsDebuggerPresent June 9, 2021, 9:45 a.m.			0	0
IsDebuggerPresent June 9, 2021, 9:45 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 138 events)

Time & API	Arguments	Status	Return
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001a4570 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002169b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002169b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002169b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8177f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8177f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8177f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817d30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817d30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817d30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001a4500 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001a4500 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8180b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8180b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b818120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b818120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b83bdd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b83bdd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 9, 2021, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b870600 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 9, 2021, 9:48 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.symtab

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 9, 2021, 9:46 a.m.	stacktrace: atol+0x62 qsort-0x202 ntdll+0x664e @ 0x771c664e strtol+0x16a __C_specific_handler-0x212 ntdll+0x182fa @ 0x771d82fa KiUserApcDispatcher+0x2b KiUserCallbackDispatcher-0xdb ntdll+0x5112b @ 0x7721112b NtDelayExecution+0xa NtQueryDirectoryFile-0x6 ntdll+0x5165a @ 0x7721165a New_ntdll_NtDelayExecution+0xda New_ntdll_NtDeleteFile-0x64 @ 0x72e2135f SleepEx+0xb3 GetLastError-0x5d kernelbase+0x1203 @ 0x7fefd6d1203 TranslateSecurityAttributes+0xbd50 LegacyNGenTryEnumerateFusionCache-0x2ce0 mscorwks+0x727490 @ 0x7feeb717490 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521 exception.instruction_r: 8b 01 85 c0 0f 8e 35 1a 02 00 3d ff ff ff 7f 0f exception.symbol: atol+0x62 qsort-0x202 ntdll+0x664e exception.instruction: mov eax, dword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 26190 exception.address: 0x771c664e registers.r14: 0 registers.r15: 0 registers.rcx: 8787503087616 registers.rsi: 0 registers.r10: 1706832 registers.rbx: 0 registers.rsp: 449837968 registers.r11: 449836120 registers.r8: 32 registers.r9: 461898496 registers.rdx: 449836048 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 8787503087615 registers.r13: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 372 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028940000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028a30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2a6b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028a50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ffffef0000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ffffef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028bc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028bc4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028bc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000028bc7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92da0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92da1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 9, 2021, 9:48 a.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92da2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (3 events)

file	c:\Users\test22\AppData\Local\Temp\1sxnmgiv.dll
file	C:\Users\test22\AppData\Local\Temp\ready.ps1
file	C:\Users\test22\AppData\Local\Temp\resolve-domain.ps1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\1sxnmgiv.dll

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 9, 2021, 9:48 a.m.	thread_identifier: 6420 thread_handle: 0x0000000000000248 process_identifier: 2120 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell.exe" -ep bypass & 'C:\Users\test22\AppData\Local\Temp\\ready.ps1' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000000000002e8	1	1	0
CreateProcessInternalW June 9, 2021, 9:45 a.m.	thread_identifier: 5572 thread_handle: 0x0000000000000424 process_identifier: 8004 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000043c	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 9, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 9, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\1sxnmgiv.cmdline"

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Deletes executed files from disk (2 events)

file	C:\Users\test22\AppData\Local\Temp\RESE77.tmp
file	c:\Users\test22\AppData\Local\Temp\CSCE18.tmp

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\1sxnmgiv.cmdline"
parent_process	powershell.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile

Creates a suspicious Powershell process (3 events)

option	-ep bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-nologo	value	Hides the copyright banner when PowerShell launches

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress June 9, 2021, 9:48 a.m.	ordinal: 0 function_address: 0x000007feff017a50 function_name: wine_get_version module: ntdll module_address: 0x00000000771c0000		-1073741511	0

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoad4.14404
McAfee	Artemis!20F307C716A6
Cylance	Unsafe
AegisLab	Trojan.MSIL.Agent.b!c
CrowdStrike	win/malicious_confidence_70% (W)
Alibaba	Trojan:Win32/GoCLR.9fb1630a
K7GW	Trojan ( 00578ee41 )
Symantec	Trojan.Gen.9
ESET-NOD32	a variant of WinGo/GoCLR.A
APEX	Malicious
ClamAV	Win.Malware.Bulz-9847817-0
Kaspersky	UDS:Trojan-Dropper.MSIL.Agent
Avast	FileRepMalware
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win64.TrojanVeil.vh
Webroot	W32.Trojan.Agent.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Malwarebytes	Malware.AI.1001955101
TrendMicro-HouseCall	TROJ_GEN.R002H0DF821
Ikarus	Trojan.CobaltStrike
eGambit	Unsafe.AI_Score_100%
Fortinet	W64/GoCLR.A!tr
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware

Executed a process and injected code into it, probably while unpacking (50 out of 364 events)

Time & API	Arguments	Status
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e4	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e4 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e4	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e4 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e4	1
NtSetContextThread June 9, 2021, 9:48 a.m.	registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 824634211432 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rip: 4622912 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0 thread_handle: 0x00000000000000e4 process_identifier: 7528	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e4 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e4	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e4 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e8	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000000e8 suspend_count: 1 process_identifier: 7528	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x000000000000015c suspend_count: 1 process_identifier: 7528	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000001cc suspend_count: 1 process_identifier: 7528	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x0000000000000210 suspend_count: 1 process_identifier: 7528	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x000000000000024c suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x0000000000000160	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x0000000000000160	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x0000000000000160 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x000000000000023c	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x000000000000023c suspend_count: 1 process_identifier: 7528	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x0000000000000290 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002bc	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002bc suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e4	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e4 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8	1
NtResumeThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002e8 suspend_count: 1 process_identifier: 7528	1
NtGetContextThread June 9, 2021, 9:48 a.m.	thread_handle: 0x00000000000002ec	1

al.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All