Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 1, 2021, 9:14 a.m.	Aug. 1, 2021, 9:31 a.m.

Size	100.0KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`250a5f8df1e6ede5f3853add72080308`
SHA256	`1d928c0f640e731208adc0736aca791af0ba7e7dfdad0800d9de2fc968ef0010`
CRC32	`1FECEAF2`
ssdeep	`1536:Om386AEAV9cBdsTnbmQzE7FQgbueqvauvNyAsduTi1xQeTEGG6WAaoigj:Oi86AdXSaiQzEhdYaulyddbsvEz`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file IsPE32 - (no description) PE_Header_Zero - PE File Signature Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

@Stewor.exe "C:\Users\test22\AppData\Local\Temp\@Stewor.exe"
1116
- build.exe "C:\Users\test22\AppData\Local\Temp\build.exe"
  2584

Name	Response	Post-Analysis Lookup
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.135.233
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.12.31

IP Address	Status	Action
162.159.129.233	Active	Moloch
164.124.101.2	Active	Moloch
172.67.75.172	Active	Moloch
95.217.159.87	Active	Moloch
80.15.2.105	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49163 -> 172.67.75.172:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49173 -> 162.159.129.233:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 95.217.159.87:4348 -> 192.168.56.102:49161	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 95.217.159.87:4348 -> 192.168.56.102:49161	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49163 172.67.75.172:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e
TLS 1.2 192.168.56.102:49173 162.159.129.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	54:e1:a7:9d:cc:c8:60:86:f1:a5:da:74:0e:5a:ab:45:df:37:8a:78

Queries for the computername (15 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:15 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:15 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 1, 2021, 9:15 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 1, 2021, 9:14 a.m.			0	0
IsDebuggerPresent Aug. 1, 2021, 9:14 a.m.			0	0
IsDebuggerPresent Aug. 1, 2021, 9:15 a.m.			0	0
IsDebuggerPresent Aug. 1, 2021, 9:15 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a4f08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a4f08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a4f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054f640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054f640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054f480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054fa40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054fac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 1, 2021, 9:14 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054fac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 1, 2021, 9:14 a.m.		1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Aug. 1, 2021, 9:14 a.m.	stacktrace: 0x923502 0x923484 0x921982 0x92085c 0x920070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73a72652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73a8264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73a82e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73b374ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73b37610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73bc1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73bc1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73bc1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73bc416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7411f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x923591 registers.esp: 3928604 registers.edi: 37342080 registers.eax: 0 registers.ebp: 3928628 registers.edx: 4794312 registers.ebx: 36578088 registers.esi: 37342260 registers.ecx: 0	1
__exception__ Aug. 1, 2021, 9:14 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73c21194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73af2ba1 system+0x1c9b2b @ 0x73839b2b system+0x1d0897 @ 0x73840897 system+0x1cf893 @ 0x7383f893 system+0x714b8 @ 0x736e14b8 system+0x1979c9 @ 0x738079c9 system+0x1a0096 @ 0x73810096 0x4d91860 system+0x70163 @ 0x736e0163 system+0x6ea04 @ 0x736dea04 system+0x6e998 @ 0x736de998 system+0x63a0f @ 0x736d3a0f system+0x636a6 @ 0x736d36a6 system+0x634a5 @ 0x736d34a5 system+0x633fd @ 0x736d33fd system+0x398930 @ 0x6ffb8930 system+0x3988a7 @ 0x6ffb88a7 system+0x39884b @ 0x6ffb884b system+0x3987c4 @ 0x6ffb87c4 system+0x39875a @ 0x6ffb875a system+0x3986a3 @ 0x6ffb86a3 system+0x3df871 @ 0x6ffff871 system+0x3df5ae @ 0x6ffff5ae system+0x3df38f @ 0x6ffff38f system+0x39e56f @ 0x6ffbe56f system+0x39e49a @ 0x6ffbe49a system+0x39e191 @ 0x6ffbe191 system+0x39b102 @ 0x6ffbb102 system+0x39acf6 @ 0x6ffbacf6 system+0x39ac24 @ 0x6ffbac24 system+0x3e2c08 @ 0x70002c08 system+0x3e292b @ 0x7000292b system+0x3e204b @ 0x7000204b mscorlib+0x318a5a @ 0x72218a5a DllUnregisterServerInternal-0x7943 clr+0x27b1 @ 0x73a727b1 DllGetClassObjectInternal+0x7b5c5 CorDllMainForThunk-0x10f36 clr+0x14063e @ 0x73bb063e DllGetClassObjectInternal+0x8438c CorDllMainForThunk-0x816f clr+0x149405 @ 0x73bb9405 0x4425a4 0x92ff7d 0x9208f2 0x920070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73a72652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73a8264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73a82e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73b374ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73b37610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73bc1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73bc1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73bc1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73bc416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7411f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x748ab727 registers.esp: 3926016 registers.edi: 0 registers.eax: 3926016 registers.ebp: 3926096 registers.edx: 2 registers.ebx: 102768736 registers.esi: 4794312 registers.ecx: 204274442	1
__exception__ Aug. 1, 2021, 9:15 a.m.	stacktrace: 0x7fe92e971e2 0x7fe92e900de CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef255f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef255f242 CoUninitializeEE+0x4f7a7 GetMetaDataInternalInterface-0x27f75 clr+0x5294b @ 0x7fef256294b CoUninitializeEE+0x4f782 GetMetaDataInternalInterface-0x27f9a clr+0x52926 @ 0x7fef2562926 CoUninitializeEE+0x4fece GetMetaDataInternalInterface-0x2784e clr+0x53072 @ 0x7fef2563072 CoUninitializeEE+0x4fdae GetMetaDataInternalInterface-0x2796e clr+0x52f52 @ 0x7fef2562f52 CoUninitializeEE+0x4f67f GetMetaDataInternalInterface-0x2809d clr+0x52823 @ 0x7fef2562823 NGenCreateNGenWorker+0x4875 _AxlPublicKeyBlobToPublicKeyToken-0x42997 clr+0x2142d9 @ 0x7fef27242d9 getJit-0xc697 clrjit+0x94b49 @ 0x7fef0ee4b49 getJit-0xc67a clrjit+0x94b66 @ 0x7fef0ee4b66 getJit-0x4d446 clrjit+0x53d9a @ 0x7fef0ea3d9a getJit-0x4d52d clrjit+0x53cb3 @ 0x7fef0ea3cb3 getJit-0x86719 clrjit+0x1aac7 @ 0x7fef0e6aac7 getJit-0x81eca clrjit+0x1f316 @ 0x7fef0e6f316 getJit-0x8057b clrjit+0x20c65 @ 0x7fef0e70c65 getJit-0x805da clrjit+0x20c06 @ 0x7fef0e70c06 getJit-0x9b4b9 clrjit+0x5d27 @ 0x7fef0e55d27 getJit-0x89eb5 clrjit+0x1732b @ 0x7fef0e6732b PreBindAssemblyEx+0x1d9fa CreateHistoryReader-0x5526a clr+0x1207ee @ 0x7fef26307ee PreBindAssemblyEx+0x1d94b CreateHistoryReader-0x55319 clr+0x12073f @ 0x7fef263073f PreBindAssemblyEx+0x1d83a CreateHistoryReader-0x5542a clr+0x12062e @ 0x7fef263062e PreBindAssemblyEx+0x1d718 CreateHistoryReader-0x5554c clr+0x12050c @ 0x7fef263050c StrongNameTokenFromPublicKey+0x893a SetRuntimeInfo-0x33006 clr+0x9e88a @ 0x7fef25ae88a CoUninitializeEE+0x4d7cd GetMetaDataInternalInterface-0x29f4f clr+0x50971 @ 0x7fef2560971 CoUninitializeEE+0x4cd27 GetMetaDataInternalInterface-0x2a9f5 clr+0x4fecb @ 0x7fef255fecb DllRegisterServerInternal-0xcc6 clr+0x24da @ 0x7fef25124da CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef255f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef255f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef255f30b _CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef26f721c _CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef26f7976 _CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef26f7870 _CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef26f73e6 _CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef26f733e _CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef26f3ed4 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef32f74e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3395b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7689652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76fac521 exception.instruction_r: 80 3b 00 48 8b cb e8 c3 f9 4e 5e 4c 8b e0 33 ff exception.instruction: cmp byte ptr [rbx], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe92e971e2 registers.r14: 0 registers.r15: 0 registers.rcx: 44117152 registers.rsi: 0 registers.r10: 8789966666856 registers.rbx: 0 registers.rsp: 6225536 registers.r11: 6210000 registers.r8: 8791569632501 registers.r9: 1 registers.rdx: 6222992 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 1, 2021, 9:14 a.m.

stacktrace:

0x923502
0x923484
0x921982
0x92085c
0x920070
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73a72652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73a8264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73a82e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73b374ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73b37610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73bc1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73bc1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73bc1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73bc416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7411f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x923591
registers.esp: 3928604
registers.edi: 37342080
registers.eax: 0
registers.ebp: 3928628
registers.edx: 4794312
registers.ebx: 36578088
registers.esi: 37342260
registers.ecx: 0

__exception__

Aug. 1, 2021, 9:14 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73c21194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73af2ba1
system+0x1c9b2b @ 0x73839b2b
system+0x1d0897 @ 0x73840897
system+0x1cf893 @ 0x7383f893
system+0x714b8 @ 0x736e14b8
system+0x1979c9 @ 0x738079c9
system+0x1a0096 @ 0x73810096
0x4d91860
system+0x70163 @ 0x736e0163
system+0x6ea04 @ 0x736dea04
system+0x6e998 @ 0x736de998
system+0x63a0f @ 0x736d3a0f
system+0x636a6 @ 0x736d36a6
system+0x634a5 @ 0x736d34a5
system+0x633fd @ 0x736d33fd
system+0x398930 @ 0x6ffb8930
system+0x3988a7 @ 0x6ffb88a7
system+0x39884b @ 0x6ffb884b
system+0x3987c4 @ 0x6ffb87c4
system+0x39875a @ 0x6ffb875a
system+0x3986a3 @ 0x6ffb86a3
system+0x3df871 @ 0x6ffff871
system+0x3df5ae @ 0x6ffff5ae
system+0x3df38f @ 0x6ffff38f
system+0x39e56f @ 0x6ffbe56f
system+0x39e49a @ 0x6ffbe49a
system+0x39e191 @ 0x6ffbe191
system+0x39b102 @ 0x6ffbb102
system+0x39acf6 @ 0x6ffbacf6
system+0x39ac24 @ 0x6ffbac24
system+0x3e2c08 @ 0x70002c08
system+0x3e292b @ 0x7000292b
system+0x3e204b @ 0x7000204b
mscorlib+0x318a5a @ 0x72218a5a
DllUnregisterServerInternal-0x7943 clr+0x27b1 @ 0x73a727b1
DllGetClassObjectInternal+0x7b5c5 CorDllMainForThunk-0x10f36 clr+0x14063e @ 0x73bb063e
DllGetClassObjectInternal+0x8438c CorDllMainForThunk-0x816f clr+0x149405 @ 0x73bb9405
0x4425a4
0x92ff7d
0x9208f2
0x920070
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73a72652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73a8264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73a82e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73b374ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73b37610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73bc1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73bc1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73bc1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73bc416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7411f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743a7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743a4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x748ab727
registers.esp: 3926016
registers.edi: 0
registers.eax: 3926016
registers.ebp: 3926096
registers.edx: 2
registers.ebx: 102768736
registers.esi: 4794312
registers.ecx: 204274442

__exception__

Aug. 1, 2021, 9:15 a.m.

stacktrace:

0x7fe92e971e2
0x7fe92e900de
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef255f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef255f242
CoUninitializeEE+0x4f7a7 GetMetaDataInternalInterface-0x27f75 clr+0x5294b @ 0x7fef256294b
CoUninitializeEE+0x4f782 GetMetaDataInternalInterface-0x27f9a clr+0x52926 @ 0x7fef2562926
CoUninitializeEE+0x4fece GetMetaDataInternalInterface-0x2784e clr+0x53072 @ 0x7fef2563072
CoUninitializeEE+0x4fdae GetMetaDataInternalInterface-0x2796e clr+0x52f52 @ 0x7fef2562f52
CoUninitializeEE+0x4f67f GetMetaDataInternalInterface-0x2809d clr+0x52823 @ 0x7fef2562823
NGenCreateNGenWorker+0x4875 _AxlPublicKeyBlobToPublicKeyToken-0x42997 clr+0x2142d9 @ 0x7fef27242d9
getJit-0xc697 clrjit+0x94b49 @ 0x7fef0ee4b49
getJit-0xc67a clrjit+0x94b66 @ 0x7fef0ee4b66
getJit-0x4d446 clrjit+0x53d9a @ 0x7fef0ea3d9a
getJit-0x4d52d clrjit+0x53cb3 @ 0x7fef0ea3cb3
getJit-0x86719 clrjit+0x1aac7 @ 0x7fef0e6aac7
getJit-0x81eca clrjit+0x1f316 @ 0x7fef0e6f316
getJit-0x8057b clrjit+0x20c65 @ 0x7fef0e70c65
getJit-0x805da clrjit+0x20c06 @ 0x7fef0e70c06
getJit-0x9b4b9 clrjit+0x5d27 @ 0x7fef0e55d27
getJit-0x89eb5 clrjit+0x1732b @ 0x7fef0e6732b
PreBindAssemblyEx+0x1d9fa CreateHistoryReader-0x5526a clr+0x1207ee @ 0x7fef26307ee
PreBindAssemblyEx+0x1d94b CreateHistoryReader-0x55319 clr+0x12073f @ 0x7fef263073f
PreBindAssemblyEx+0x1d83a CreateHistoryReader-0x5542a clr+0x12062e @ 0x7fef263062e
PreBindAssemblyEx+0x1d718 CreateHistoryReader-0x5554c clr+0x12050c @ 0x7fef263050c
StrongNameTokenFromPublicKey+0x893a SetRuntimeInfo-0x33006 clr+0x9e88a @ 0x7fef25ae88a
CoUninitializeEE+0x4d7cd GetMetaDataInternalInterface-0x29f4f clr+0x50971 @ 0x7fef2560971
CoUninitializeEE+0x4cd27 GetMetaDataInternalInterface-0x2a9f5 clr+0x4fecb @ 0x7fef255fecb
DllRegisterServerInternal-0xcc6 clr+0x24da @ 0x7fef25124da
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef255f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef255f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef255f30b
_CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef26f721c
_CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef26f7976
_CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef26f7870
_CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef26f73e6
_CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef26f733e
_CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef26f3ed4
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef32f74e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3395b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7689652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76fac521

exception.instruction_r: 80 3b 00 48 8b cb e8 c3 f9 4e 5e 4c 8b e0 33 ff
exception.instruction: cmp byte ptr [rbx], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe92e971e2
registers.r14: 0
registers.r15: 0
registers.rcx: 44117152
registers.rsi: 0
registers.r10: 8789966666856
registers.rbx: 0
registers.rsp: 6225536
registers.r11: 6210000
registers.r8: 8791569632501
registers.r9: 1
registers.rdx: 6222992
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET https://api.ip.sb/geoip
suspicious_features	GET method with no useragent header				suspicious_request	GET https://cdn.discordapp.com/attachments/869637885320658957/869638145543663646/build.exe

Performs some HTTP requests (2 events)

request	GET https://api.ip.sb/geoip
request	GET https://cdn.discordapp.com/attachments/869637885320658957/869638145543663646/build.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 104 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00442000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00575000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00566000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00921000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00568000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d9f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00922000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cc72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00923000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00569000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00924000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00925000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00926000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00927000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00928000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00929000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\build.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\build.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 1, 2021, 9:14 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 1, 2021, 9:14 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (50 out of 53 events)

Time & API	Arguments	Status
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000005e8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: 7-Zip base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: AddressBook base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: Adobe AIR base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: Connection Manager base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: DirectDrawEx base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: EditPlus base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: ePageSafer base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: Fontcore base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: Google Chrome base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: IE40 base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: IE4Data base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: IE5BAKEX base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: IEData base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: MobileOptionPack base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: Office14.PROPLUS base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: SchedulingAgent base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: TouchEn nxKey base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: UnINISafeWeb base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: UnINISafeWeb6 base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: WIC base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1 base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1 base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {8941A397-4065-4F41-92CE-0EB610846EED}_is1 base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-006E-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-00A1-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {90140000-00BA-0412-0000-0000000FF1CE} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Aug. 1, 2021, 9:14 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000005e8 key_handle: 0x0000024c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1

Communicates with host for which no DNS query was performed (2 events)

host	95.217.159.87
host	80.15.2.105

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Collects information about installed applications (40 events)

Time & API	Arguments	Status
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 6.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Delfino G3 (x86) version 3.6.6.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: G2BRUN regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: WIZVERA Process Manager 1,0,5,4 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Reader 9 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName	1
RegQueryValueExW Aug. 1, 2021, 9:14 a.m.	key_handle: 0x0000024c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.582621
McAfee	GenericRXOY-GA!250A5F8DF1E6
Sangfor	Trojan.Win32.Save.a
Cyren	W32/MSIL_Agent.BJO.gen!Eldorado
ESET-NOD32	a variant of MSIL/Spy.Agent.DFY
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.MSIL.Reline.gen
BitDefender	Gen:Variant.Bulz.582621
Avast	Win32:PWSX-gen [Trj]
Rising	Stealer.Agent!1.D483 (CLASSIC)
Ad-Aware	Gen:Variant.Bulz.582621
Sophos	Mal/Reline-B
DrWeb	Trojan.PWS.Siggen3.1576
McAfee-GW-Edition	GenericRXOY-GA!250A5F8DF1E6
FireEye	Generic.mg.250a5f8df1e6ede5
Emsisoft	Gen:Variant.Bulz.582621 (B)
SentinelOne	Static AI - Suspicious PE
MAX	malware (ai score=88)
Microsoft	Trojan:Win32/AgentTesla!ml
GData	Gen:Variant.Bulz.582621
Cynet	Malicious (score: 100)
AhnLab-V3	Infostealer/Win.RedLine.C4565803
Malwarebytes	Spyware.PasswordStealer
Ikarus	Trojan-Spy.MSIL.Agent
Fortinet	MSIL/Agent.DFY!tr.spy
BitDefenderTheta	Gen:NN.ZemsilF.34050.gm0@ayMqSdj
AVG	Win32:PWSX-gen [Trj]
MaxSecure	Trojan.Malware.300983.susgen

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1116	1	0
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 1116	1	0
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1116	1	0
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x00000364 suspend_count: 1 process_identifier: 1116	1	0
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x0000063c suspend_count: 1 process_identifier: 1116	1	0
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 1116	1	0
NtGetContextThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x000000f0	1	0
NtGetContextThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x000000f0	1	0
NtGetContextThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x000000f0	1	0
NtSetContextThread Aug. 1, 2021, 9:14 a.m.	registers.eip: 1940859780 registers.esp: 3926224 registers.edi: 41963572 registers.eax: 55 registers.ebp: 3926304 registers.edx: 41963572 registers.ebx: 53533317 registers.esi: 36830720 registers.ecx: 53533137 thread_handle: 0x000000f0 process_identifier: 1116	1	0
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x000000f0 suspend_count: 1 process_identifier: 1116	1	0
NtResumeThread Aug. 1, 2021, 9:15 a.m.	thread_handle: 0x00000344 suspend_count: 1 process_identifier: 1116	1	0
CreateProcessInternalW Aug. 1, 2021, 9:15 a.m.	thread_identifier: 2588 thread_handle: 0x000007c4 process_identifier: 2584 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\build.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\build.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\build.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000007cc	1	1
NtGetContextThread Aug. 1, 2021, 9:15 a.m.	thread_handle: 0x0000015c	1	0
NtResumeThread Aug. 1, 2021, 9:15 a.m.	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 1116	1	0
NtResumeThread Aug. 1, 2021, 9:15 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2584	1	0
NtResumeThread Aug. 1, 2021, 9:15 a.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 2584	1	0
NtResumeThread Aug. 1, 2021, 9:15 a.m.	thread_handle: 0x0000000000000178 suspend_count: 1 process_identifier: 2584	1	0

@Stewor.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All