Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 26, 2021, 9:23 a.m.	July 26, 2021, 9:25 a.m.

Size	724.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5	`5c7a96e9e751658f051daa79ac1e4cf0`
SHA256	`a6d3f74228ee18a19579010cd5fe3cc98f2c53dc43452325ba57a69f1253d7a5`
CRC32	`1A7B42CC`
ssdeep	`12288:GY20AljdZgBPfKfrLQxAogJfqsUsz0cX0wJxzGn+jKyiiTquHVQ:P20gPgFKjLQxAVBbIcXr6n+LTqsVQ`
PDB Path	d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Yara	IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

file3.exe "C:\Users\test22\AppData\Local\Temp\file3.exe"
2232
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\inst1\datapjgf\5g56656161.vbs" /f=CREATE_NO_WINDOW install.cmd
  1824
  - cmd.exe cmd /c ""C:\inst1\datapjgf\yui.bat" "
    2988
    - timeout.exe timeout 7
      2324
    - hock.exe "hock.exe" e -pfile kool.rar
      2540
    - timeout.exe timeout 6
      2656
    - wscript.exe "C:\Windows\System32\WScript.exe" "C:\inst1\datapjgf\als.vbs"
      2196
      - cmd.exe cmd /c ""C:\inst1\datapjgf\fsp.bat" "
        2428
        
        attrib.exe attrib +s +h "C:\inst1"
        584
        
        timeout.exe timeout 2
        2532
        
        sid.exe sid.exe /start
        2660
        
        sid.exe sid.exe /start
        2692
        
        taskkill.exe taskkill /f /im hock.exe
        1224
        
        taskkill.exe taskkill /f /im hock.exe
        872
        
        attrib.exe attrib -s -h "C:\inst1\datapjgf"
        2088
        
        timeout.exe timeout 4
        1756
    - timeout.exe timeout 8
      1572

Name	Response	Post-Analysis Lookup
stanntinab.xyz	A 193.106.175.53	193.106.175.53
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.12.31

IP Address	Status	Action
104.26.13.31	Active	Moloch
164.124.101.2	Active	Moloch
193.106.175.53	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49230 -> 104.26.13.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 193.106.175.53:80 -> 192.168.56.101:49222	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49230 104.26.13.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e

Queries for the computername (14 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 26, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 26, 2021, 9:23 a.m.			0	0
IsDebuggerPresent July 26, 2021, 9:23 a.m.			0	0

Command line console output was observed (27 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: 'gtrergtrgtrgrgtr' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW July 26, 2021, 9:24 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Waiting for 7 console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: RAR 5.50 beta 1 x86 Copyright (c) 1993-2017 Alexander Roshal 12 Apr 2017 console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Trial version Type 'rar -?' for help console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Extracting from kool.rar console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Extracting als.vbs console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: OK console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Extracting fsp.bat console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: OK console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Extracting sid.exe console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: OK console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: All OK console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Waiting for 6 console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Waiting for 8 console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:24 a.m.	buffer: C:\inst1\datapjgf\sid.exe console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:24 a.m.	buffer: Access is denied. console_handle: 0x0000000b	1	1
WriteConsoleW July 26, 2021, 9:24 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Waiting for 2 console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: ERROR: The process "hock.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: ERROR: The process "hock.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: Waiting for 4 console_handle: 0x00000007	1	1
WriteConsoleW July 26, 2021, 9:23 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (13 events)

Time & API	Arguments	Status	Return
CryptExportKey July 26, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006293b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006293b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006293f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006293f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006293f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006293f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00629670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05cc11b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05cc11b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05cc1070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05cc14f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05cc1570 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 26, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05cc1570 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 26, 2021, 9:23 a.m.		1	1	0

One or more processes crashed (13 events)

Time & API	Arguments	Status
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21a24ba 0x21a2437 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21a2549 registers.esp: 1633772 registers.edi: 37906184 registers.eax: 0 registers.ebp: 1633796 registers.edx: 6375864 registers.ebx: 37112688 registers.esi: 37906364 registers.ecx: 0	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ac037 0x21abf79 0x21abb2c 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633548 registers.edi: 38145520 registers.eax: 0 registers.ebp: 1633592 registers.edx: 110371548 registers.ebx: 38145324 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ac037 0x21abf79 0x21abb2c 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633548 registers.edi: 39111076 registers.eax: 0 registers.ebp: 1633592 registers.edx: 110371548 registers.ebx: 39110880 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ac037 0x21abf79 0x21abb2c 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633548 registers.edi: 40063092 registers.eax: 0 registers.ebp: 1633592 registers.edx: 110371548 registers.ebx: 40062896 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21adb56 0x21adaa9 0x21abba1 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633540 registers.edi: 41014872 registers.eax: 0 registers.ebp: 1633584 registers.edx: 110371548 registers.ebx: 41014676 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21adb56 0x21adaa9 0x21abba1 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633540 registers.edi: 41978292 registers.eax: 0 registers.ebp: 1633584 registers.edx: 110371548 registers.ebx: 41978096 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21adb56 0x21adaa9 0x21abba1 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633540 registers.edi: 38364360 registers.eax: 0 registers.ebp: 1633584 registers.edx: 110371548 registers.ebx: 38364164 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ae0b7 0x21ae009 0x21abc16 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633544 registers.edi: 37945860 registers.eax: 0 registers.ebp: 1633588 registers.edx: 110371548 registers.ebx: 37945664 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ae0b7 0x21ae009 0x21abc16 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633544 registers.edi: 39506052 registers.eax: 0 registers.ebp: 1633588 registers.edx: 110371548 registers.ebx: 39505856 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ae0b7 0x21ae009 0x21abc16 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633544 registers.edi: 40522160 registers.eax: 0 registers.ebp: 1633588 registers.edx: 110371548 registers.ebx: 40521964 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ae4f9 0x21ae449 0x21abc85 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633540 registers.edi: 41538448 registers.eax: 0 registers.ebp: 1633584 registers.edx: 110371548 registers.ebx: 41538252 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ae4f9 0x21ae449 0x21abc85 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633540 registers.edi: 38463456 registers.eax: 0 registers.ebp: 1633584 registers.edx: 110371548 registers.ebx: 38463260 registers.esi: 0 registers.ecx: 110372072	1
__exception__ July 26, 2021, 9:24 a.m.	stacktrace: 0x21ae4f9 0x21ae449 0x21abc85 0x21ab59f 0x21a1d02 0x21a0c24 0x21a0438 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d36ad @ 0x6fe736ad mscorlib+0x308f2d @ 0x6fea8f2d 0x21a0398 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72231838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72231737 mscorlib+0x2d3711 @ 0x6fe73711 mscorlib+0x308f2d @ 0x6fea8f2d mscorlib+0x3133fd @ 0x6feb33fd mscorlib+0x9873b1 @ 0x705273b1 mscorlib+0x97b352 @ 0x7051b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x721b2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x722acd14 0x4aa062 sid+0x2403 @ 0x402403 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21ac3d3 registers.esp: 1633540 registers.edi: 39481684 registers.eax: 0 registers.ebp: 1633584 registers.edx: 110371548 registers.ebx: 39481488 registers.esi: 0 registers.ecx: 110372072	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST http://stanntinab.xyz/
suspicious_features	GET method with no useragent header				suspicious_request	GET https://api.ip.sb/geoip

Performs some HTTP requests (2 events)

request	POST http://stanntinab.xyz/
request	GET https://api.ip.sb/geoip

Sends data using the HTTP POST Method (1 event)

request

POST http://stanntinab.xyz/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 159 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a34000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a72000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72691000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72661000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a34000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a72000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72691000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72661000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ad1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72894000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72962000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Creates executable files on the filesystem (6 events)

file	C:\inst1\datapjgf\hock.exe
file	C:\inst1\datapjgf\5g56656161.vbs
file	C:\inst1\datapjgf\fsp.bat
file	C:\inst1\datapjgf\yui.bat
file	C:\inst1\datapjgf\sid.exe
file	C:\inst1\datapjgf\als.vbs

Drops a binary and executes it (5 events)

file	C:\inst1\datapjgf\5g56656161.vbs
file	C:\inst1\datapjgf\hock.exe
file	C:\inst1\datapjgf\als.vbs
file	C:\inst1\datapjgf\fsp.bat
file	C:\inst1\datapjgf\sid.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 26, 2021, 9:23 a.m.	show_type: 0 filepath_r: yui.bat parameters: filepath: yui.bat	1	1	0
ShellExecuteExW July 26, 2021, 9:23 a.m.	show_type: 0 filepath_r: C:\inst1\datapjgf\fsp.bat parameters: filepath: C:\inst1\datapjgf\fsp.bat	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 26, 2021, 9:23 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 26, 2021, 9:24 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 26, 2021, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 26, 2021, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (24 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000081c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: AddressBook base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: Connection Manager base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: DirectDrawEx base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: EditPlus base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: ENTERPRISE base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: Fontcore base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: Google Chrome base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: IE40 base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: IE4Data base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: IE5BAKEX base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: IEData base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: MobileOptionPack base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: SchedulingAgent base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: WIC base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW July 26, 2021, 9:24 a.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x0000081c key_handle: 0x00000810 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	attrib +s +h "C:\inst1"
cmdline	taskkill /f /im hock.exe
cmdline	attrib -s -h "C:\inst1\datapjgf"

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 9cf75efa54e1d2afe93d0e7f7e1aef13d32f04ee

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2692 region_size: 212992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000e0	1	0	0

Deletes executed files from disk (1 event)

file	C:\inst1\datapjgf\yui.bat

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (9 events)

wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor
wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "hock.exe")

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 26, 2021, 9:23 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2692 process_handle: 0x000000e0	1	1	0

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW July 26, 2021, 9:24 a.m.	key_handle: 0x00000810 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Lionic	Trojan.MSIL.Reline.i!c
FireEye	Generic.mg.5c7a96e9e751658f
McAfee	Artemis!5C7A96E9E751
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	Artemis!PUP
Ikarus	Trojan.Inject
eGambit	PE.Heur.InvalidSig
Microsoft	Trojan:Linux/Multiverze
Cynet	Malicious (score: 100)
Malwarebytes	Malware.AI.4126107312
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Heur.Generic.HwYD08cA

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2660 called NtSetContextThread to modify thread in remote process 2692
NtSetContextThread July 26, 2021, 9:23 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4246831 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000dc process_identifier: 2692	1	0	0

One or more non-whitelisted processes were created (4 events)

parent_process	wscript.exe	martian_process	"C:\inst1\datapjgf\yui.bat"
parent_process	wscript.exe	martian_process	yui.bat
parent_process	wscript.exe	martian_process	C:\inst1\datapjgf\fsp.bat
parent_process	wscript.exe	martian_process	"C:\inst1\datapjgf\fsp.bat"

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2232 resumed a thread in remote process 1824
Process injection	Process 2988 resumed a thread in remote process 2196
Process injection	Process 2660 resumed a thread in remote process 2692
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 1824	1	0	0
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x00000240 suspend_count: 1 process_identifier: 2196	1	0	0
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2692	1	0	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

Executed a process and injected code into it, probably while unpacking (49 events)

Time & API	Arguments	Status	Return
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 2232	1	0
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 1556 thread_handle: 0x00000298 process_identifier: 1824 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\inst1\datapjgf\5g56656161.vbs" /f=CREATE_NO_WINDOW install.cmd filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000029c	1	1
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 1824	1	0
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 2164 thread_handle: 0x000002fc process_identifier: 2988 current_directory: C:\inst1\datapjgf filepath: track: 1 command_line: "C:\inst1\datapjgf\yui.bat" filepath_r: stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f0	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 2112 thread_handle: 0x000000f8 process_identifier: 2324 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 7 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f4	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 2492 thread_handle: 0x000000f8 process_identifier: 2540 current_directory: C:\inst1\datapjgf filepath: C:\inst1\datapjgf\hock.exe track: 1 command_line: "hock.exe" e -pfile kool.rar filepath_r: C:\inst1\datapjgf\hock.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000100	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 2412 thread_handle: 0x00000100 process_identifier: 2656 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 6 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f8	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\inst1\datapjgf\als.vbs track: 0 command_line: als.vbs filepath_r: C:\inst1\datapjgf\als.vbs stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000000		0
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 2988	1	0
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 1788 thread_handle: 0x00000240 process_identifier: 2196 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\inst1\datapjgf\als.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000023c	1	1
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x00000240 suspend_count: 1 process_identifier: 2196	1	0
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 3064 thread_handle: 0x00000244 process_identifier: 1572 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 8 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000011c	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 2264 thread_handle: 0x000002b4 process_identifier: 2428 current_directory: C:\inst1\datapjgf filepath: track: 1 command_line: "C:\inst1\datapjgf\fsp.bat" filepath_r: stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002cc	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 1332 thread_handle: 0x000000f8 process_identifier: 584 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\attrib.exe track: 1 command_line: attrib +s +h "C:\inst1" filepath_r: C:\Windows\system32\attrib.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f4	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 2664 thread_handle: 0x000000f4 process_identifier: 2532 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 2 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f8	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 1436 thread_handle: 0x000000f8 process_identifier: 2660 current_directory: C:\inst1\datapjgf filepath: C:\inst1\datapjgf\sid.exe track: 1 command_line: sid.exe /start filepath_r: C:\inst1\datapjgf\sid.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f4	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 1972 thread_handle: 0x000000f4 process_identifier: 1224 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\taskkill.exe track: 1 command_line: taskkill /f /im hock.exe filepath_r: C:\Windows\system32\taskkill.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f8	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 2444 thread_handle: 0x000000f8 process_identifier: 872 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\taskkill.exe track: 1 command_line: taskkill /f /im hock.exe filepath_r: C:\Windows\system32\taskkill.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f4	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 112 thread_handle: 0x000000f4 process_identifier: 2088 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\attrib.exe track: 1 command_line: attrib -s -h "C:\inst1\datapjgf" filepath_r: C:\Windows\system32\attrib.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f8	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 1160 thread_handle: 0x000000f8 process_identifier: 1756 current_directory: C:\inst1\datapjgf filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 4 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000f4	1	1
CreateProcessInternalW July 26, 2021, 9:23 a.m.	thread_identifier: 808 thread_handle: 0x000000dc process_identifier: 2692 current_directory: filepath: track: 1 command_line: sid.exe /start filepath_r: stack_pivoted: 0 creation_flags: 524292 (CREATE_SUSPENDED\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000000e0	1	1
NtGetContextThread July 26, 2021, 9:23 a.m.	thread_handle: 0x000000dc	1	0
NtUnmapViewOfSection July 26, 2021, 9:23 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2692 process_handle: 0x000000e0	1	0
NtAllocateVirtualMemory July 26, 2021, 9:23 a.m.	process_identifier: 2692 region_size: 212992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000e0	1	0
WriteProcessMemory July 26, 2021, 9:23 a.m.	buffer: base_address: 0x00400000 process_identifier: 2692 process_handle: 0x000000e0	1	1
WriteProcessMemory July 26, 2021, 9:23 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2692 process_handle: 0x000000e0	1	1
NtSetContextThread July 26, 2021, 9:23 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4246831 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000dc process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x00000160 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x000001d4 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:23 a.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x0000063c suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000674 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x000006f4 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000738 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000750 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000768 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000784 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x0000079c suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x000007b4 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x000007dc suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000820 suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x0000083c suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x0000085c suspend_count: 1 process_identifier: 2692	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000804 suspend_count: 1 process_identifier: 2692	1	0
NtGetContextThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000168	1	0
NtGetContextThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000168	1	0
NtResumeThread July 26, 2021, 9:24 a.m.	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2692	1	0

file3.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All