Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 10, 2021, 5:43 p.m.	Sept. 10, 2021, 5:45 p.m.

Size	436.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`e79a346563c8229ade00a77e2cebc81a`
SHA256	`68f90e7cd6f81bcd548c046cfaca36e766da7fdcdddf286ef769c30062fde895`
CRC32	`7D7AE32B`
ssdeep	`12288:1Ltdhijtuzu2H884oL4lW6ynCsV1QXq9bNAP8WLS:1Ltd9H8NoLs9yCGK6XOLS`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

WoodeProcurement_Specification_Doc_Portal2021R3_Client_index.exe "C:\Users\test22\AppData\Local\Temp\WoodeProcurement_Specification_Doc_Portal2021R3_Client_index.exe"
1328
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
  1612
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
  236
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
  1788
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
  2384
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
  1852
- RegAsm.exe C:\Users\test22\AppData\Local\Temp\RegAsm.exe
  928

Name	Response	Post-Analysis Lookup
8.8.8.8.in-addr.arpa	PTR dns.google
dns.google	A 8.8.8.8 A 8.8.4.4	8.8.4.4
ghostboy.gotdns.ch	A 213.170.203.31	213.170.203.31
time.google.com	A 216.239.35.4 A 216.239.35.8 A 216.239.35.0 A 216.239.35.12	216.239.35.12
4.4.8.8.in-addr.arpa	PTR dns.google

IP Address	Status	Action
164.124.101.2	Active	Moloch
213.170.203.31	Active	Moloch
216.239.35.4	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.102:49175 213.170.203.31:3924	None	None	None

Queries for the computername (40 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:44 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 10, 2021, 5:43 p.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 5:43 p.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 5:43 p.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 5:43 p.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 5:43 p.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 5:44 p.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 5:44 p.m.			0	0

Command line console output was observed (50 out of 70 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000043	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000047	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000013	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000017	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000001b	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000023	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000043	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000047	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x0000004f	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000013	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x00000017	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x0000001b	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 10, 2021, 5:43 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000043	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000047	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000004b	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000013	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000017	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000001b	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000023	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.8.8 8.8.8.8 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC 8.8.4.4 8.8.8.8 {} console_handle: 0x00000043	1	1
WriteConsoleW Sept. 10, 2021, 5:44 p.m.	buffer: TEST22-PC time.google.com 216.239.35.4 {} console_handle: 0x00000047	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 218 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 10, 2021, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00749408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00749508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00749508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f1b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eaf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eaf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eaf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eaf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eaf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063eaf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063e5f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063e5f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063e5f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063ecb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063f0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063efb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063e730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0063e730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x054106d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x054106d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x054106d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00281cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00282378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00282378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00282378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 10, 2021, 5:43 p.m.		1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Sept. 10, 2021, 5:44 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e 0x6bb174d 0x6bb09ae 0x6cec18 0x6b800cf system+0x1d3f63 @ 0x70073f63 0x6ca2d1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737 mscorlib+0x2d3711 @ 0x724b3711 mscorlib+0x308f2d @ 0x724e8f2d mscorlib+0x3133fd @ 0x724f33fd 0x6c1b1d 0x6c1a8c system+0xa8f89d @ 0x7152f89d system+0x1dc9c5 @ 0x70c7c9c5 system+0x1dc924 @ 0x70c7c924 0x6c091f system+0x1f9799 @ 0x70c99799 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x33a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a system+0x1ebc85 @ 0x70c8bc85 system+0x1f683b @ 0x70c9683b system+0x1e592f @ 0x70c8592f 0x6c02d6 system+0xa8f89d @ 0x7152f89d system+0x1dc9c5 @ 0x70c7c9c5 system+0x1dc924 @ 0x70c7c924 0x6c02a2 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x33a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x76a6b479 registers.esp: 4970968 registers.edi: 1969676232 registers.eax: 1376256 registers.ebp: 4971172 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 10, 2021, 5:44 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e 0x6bb174d 0x6bb09ae 0x6cec18 0x6b800cf system+0x1d3f63 @ 0x70073f63 0x6ca2d1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737 mscorlib+0x2d3711 @ 0x724b3711 mscorlib+0x308f2d @ 0x724e8f2d mscorlib+0x3133fd @ 0x724f33fd 0x6c1b1d 0x6c1a8c system+0xa8f89d @ 0x7152f89d system+0x1dc9c5 @ 0x70c7c9c5 system+0x1dc924 @ 0x70c7c924 0x6c091f system+0x1f9799 @ 0x70c99799 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x33a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a system+0x1ebc85 @ 0x70c8bc85 system+0x1f683b @ 0x70c9683b system+0x1e592f @ 0x70c8592f 0x6c02d6 system+0xa8f89d @ 0x7152f89d system+0x1dc9c5 @ 0x70c7c9c5 system+0x1dc924 @ 0x70c7c924 0x6c02a2 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x33a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x76a6b479 registers.esp: 4970968 registers.edi: 1969676232 registers.eax: 573767680 registers.ebp: 4971172 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Sept. 10, 2021, 5:44 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e 0x6bb174d 0x6bb09ae 0x6cec18 0x6b800cf system+0x1d3f63 @ 0x70073f63 0x6ca2d1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737 mscorlib+0x2d3711 @ 0x724b3711 mscorlib+0x308f2d @ 0x724e8f2d mscorlib+0x3133fd @ 0x724f33fd 0x6c1b1d 0x6c1a8c system+0xa8f89d @ 0x7152f89d system+0x1dc9c5 @ 0x70c7c9c5 system+0x1dc924 @ 0x70c7c924 0x6c091f system+0x1f9799 @ 0x70c99799 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x33a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a system+0x1ebc85 @ 0x70c8bc85 system+0x1f683b @ 0x70c9683b system+0x1e592f @ 0x70c8592f 0x6c02d6 system+0xa8f89d @ 0x7152f89d system+0x1dc9c5 @ 0x70c7c9c5 system+0x1dc924 @ 0x70c7c924 0x6c02a2 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x33a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x76a6b479 registers.esp: 4970968 registers.edi: 1969676232 registers.eax: 573767680 registers.ebp: 4971172 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 10, 2021, 5:44 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e
0x6bb174d
0x6bb09ae
0x6cec18
0x6b800cf
system+0x1d3f63 @ 0x70073f63
0x6ca2d1
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737
mscorlib+0x2d3711 @ 0x724b3711
mscorlib+0x308f2d @ 0x724e8f2d
mscorlib+0x3133fd @ 0x724f33fd
0x6c1b1d
0x6c1a8c
system+0xa8f89d @ 0x7152f89d
system+0x1dc9c5 @ 0x70c7c9c5
system+0x1dc924 @ 0x70c7c924
0x6c091f
system+0x1f9799 @ 0x70c99799
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x33a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a
system+0x1ebc85 @ 0x70c8bc85
system+0x1f683b @ 0x70c9683b
system+0x1e592f @ 0x70c8592f
0x6c02d6
system+0xa8f89d @ 0x7152f89d
system+0x1dc9c5 @ 0x70c7c9c5
system+0x1dc924 @ 0x70c7c924
0x6c02a2
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x33a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x76a6b479
registers.esp: 4970968
registers.edi: 1969676232
registers.eax: 1376256
registers.ebp: 4971172
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

Sept. 10, 2021, 5:44 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e
0x6bb174d
0x6bb09ae
0x6cec18
0x6b800cf
system+0x1d3f63 @ 0x70073f63
0x6ca2d1
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737
mscorlib+0x2d3711 @ 0x724b3711
mscorlib+0x308f2d @ 0x724e8f2d
mscorlib+0x3133fd @ 0x724f33fd
0x6c1b1d
0x6c1a8c
system+0xa8f89d @ 0x7152f89d
system+0x1dc9c5 @ 0x70c7c9c5
system+0x1dc924 @ 0x70c7c924
0x6c091f
system+0x1f9799 @ 0x70c99799
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x33a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a
system+0x1ebc85 @ 0x70c8bc85
system+0x1f683b @ 0x70c9683b
system+0x1e592f @ 0x70c8592f
0x6c02d6
system+0xa8f89d @ 0x7152f89d
system+0x1dc9c5 @ 0x70c7c9c5
system+0x1dc924 @ 0x70c7c924
0x6c02a2
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x33a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x76a6b479
registers.esp: 4970968
registers.edi: 1969676232
registers.eax: 573767680
registers.ebp: 4971172
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

Sept. 10, 2021, 5:44 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e
0x6bb174d
0x6bb09ae
0x6cec18
0x6b800cf
system+0x1d3f63 @ 0x70073f63
0x6ca2d1
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737
mscorlib+0x2d3711 @ 0x724b3711
mscorlib+0x308f2d @ 0x724e8f2d
mscorlib+0x3133fd @ 0x724f33fd
0x6c1b1d
0x6c1a8c
system+0xa8f89d @ 0x7152f89d
system+0x1dc9c5 @ 0x70c7c9c5
system+0x1dc924 @ 0x70c7c924
0x6c091f
system+0x1f9799 @ 0x70c99799
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x33a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a
system+0x1ebc85 @ 0x70c8bc85
system+0x1f683b @ 0x70c9683b
system+0x1e592f @ 0x70c8592f
0x6c02d6
system+0xa8f89d @ 0x7152f89d
system+0x1dc9c5 @ 0x70c7c9c5
system+0x1dc924 @ 0x70c7c924
0x6c02a2
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x33a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x76a6b479
registers.esp: 4970968
registers.edi: 1969676232
registers.eax: 573767680
registers.ebp: 4971172
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 794 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00322000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00355000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0035b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00357000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0032a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00347000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70822000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00346000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0032c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06b8f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06bb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ecc1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ecc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0264b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02647000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ebb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 10, 2021, 5:43 p.m.	process_identifier: 1612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02645000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

RegAsm.exe tried to sleep 261 seconds, actually delayed analysis time by 261 seconds

Steals private information from local Internet browsers (2 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_PingStatus where ((Address='8.8.8.8' Or Address='8.8.4.4' Or Address='time.google.com') And TimeToLive=80 And BufferSize=32)

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 10, 2021, 5:43 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1
ShellExecuteExW Sept. 10, 2021, 5:43 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1
ShellExecuteExW Sept. 10, 2021, 5:43 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1
ShellExecuteExW Sept. 10, 2021, 5:44 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1
ShellExecuteExW Sept. 10, 2021, 5:44 p.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath: powershell	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00068a00', u'virtual_address': u'0x00002000', u'entropy': 7.975567996024654, u'name': u'.text', u'virtual_size': u'0x00068984'}

entropy

7.97556799602

description

A section with a high entropy has been found

entropy

0.959862385321

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (6 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 10, 2021, 5:44 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 10, 2021, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 10, 2021, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 10, 2021, 5:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 10, 2021, 5:44 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 10, 2021, 5:44 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (19 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	browser info stealer	rule	infoStealer_browser_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 928 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003e0	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

reg_value

explorer.exe,"C:\Users\test22\AppData\Roaming\adobe\adobe.exe",

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà l÷0@ÜxKP80l8Älhl@0t.text¶ `.rdatao0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcxKL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ´tE¸wE²tE..¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶F¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢F¡F8zE¸{EEè¡F§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: base_address: 0x0046e000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: +ÔÔ?¤Ø¾Ø?Ù?)s?ÚuZ55g;Ù.~~Dñìð??m(À'ÆØØ®õÐûõÛÝÛÝÛ(jk¡iæÞ\F£ã¥w¡Ô(´öä¼éÙ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 928 process_handle: 0x000003e0	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà l÷0@ÜxKP80l8Älhl@0t.text¶ `.rdatao0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcxKL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 928 process_handle: 0x000003e0	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Sept. 10, 2021, 5:44 p.m.	thread_identifier: 0 callback_function: 0x004088ca hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	787111	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1328 called NtSetContextThread to modify thread in remote process 928
NtSetContextThread Sept. 10, 2021, 5:44 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4388716 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000040c process_identifier: 928	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1328 resumed a thread in remote process 928
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 928	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (42 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1328	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 1328	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1328	1	0
CreateProcessInternalW Sept. 10, 2021, 5:43 p.m.	thread_identifier: 1080 thread_handle: 0x000003cc process_identifier: 1612 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000374	1	1
CreateProcessInternalW Sept. 10, 2021, 5:43 p.m.	thread_identifier: 456 thread_handle: 0x000003f0 process_identifier: 236 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000408	1	1
CreateProcessInternalW Sept. 10, 2021, 5:43 p.m.	thread_identifier: 816 thread_handle: 0x000003e0 process_identifier: 1788 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000404	1	1
CreateProcessInternalW Sept. 10, 2021, 5:44 p.m.	thread_identifier: 2592 thread_handle: 0x000003fc process_identifier: 2384 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000408	1	1
CreateProcessInternalW Sept. 10, 2021, 5:44 p.m.	thread_identifier: 2040 thread_handle: 0x000003f0 process_identifier: 1852 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000404	1	1
CreateProcessInternalW Sept. 10, 2021, 5:44 p.m.	thread_identifier: 276 thread_handle: 0x0000040c process_identifier: 928 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\RegAsm.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003e0	1	1
NtGetContextThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x0000040c	1	0
NtAllocateVirtualMemory Sept. 10, 2021, 5:44 p.m.	process_identifier: 928 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003e0	1	0
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà l÷0@ÜxKP80l8Älhl@0t.text¶ `.rdatao0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcxKL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: base_address: 0x00401000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: base_address: 0x00453000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ´tE¸wE²tE..¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶F¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢F¡F8zE¸{EEè¡F§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: base_address: 0x0046e000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: +ÔÔ?¤Ø¾Ø?Ù?)s?ÚuZ55g;Ù.~~Dñìð??m(À'ÆØØ®õÐûõÛÝÛÝÛ(jk¡iæÞ\F£ã¥w¡Ô(´öä¼éÙ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: base_address: 0x00470000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: base_address: 0x00475000 process_identifier: 928 process_handle: 0x000003e0	1	1
WriteProcessMemory Sept. 10, 2021, 5:44 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 928 process_handle: 0x000003e0	1	1
NtSetContextThread Sept. 10, 2021, 5:44 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4388716 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000040c process_identifier: 928	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 928	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x0000029c suspend_count: 1 process_identifier: 1612	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 1612	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x0000043c suspend_count: 1 process_identifier: 1612	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000003d4 suspend_count: 1 process_identifier: 1612	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 236	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 236	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 236	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000003e0 suspend_count: 1 process_identifier: 236	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 10, 2021, 5:43 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000003dc suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2384	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2384	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2384	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000003d8 suspend_count: 1 process_identifier: 2384	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 1852	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 1852	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 1852	1	0
NtResumeThread Sept. 10, 2021, 5:44 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 1852	1	0

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Bulz.693054
Malwarebytes	Trojan.MCrypt.MSIL.Generic
Alibaba	Trojan:Win32/Maldoc.ali2000008
CrowdStrike	win/malicious_confidence_70% (W)
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Injector.VRY
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Remcos.gen
BitDefender	Gen:Variant.Bulz.693054
MicroWorld-eScan	Gen:Variant.Bulz.693054
Avast	Win32:CrypterX-gen [Trj]
Ad-Aware	Gen:Variant.Bulz.693054
Sophos	Mal/Generic-S
DrWeb	Trojan.PackedNET.1021
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
FireEye	Gen:Variant.Bulz.693054
GData	Gen:Variant.Bulz.693054
Webroot	W32.Trojan.Agent.Gen
Microsoft	Trojan:Win32/AgentTesla!ml
McAfee	Artemis!E79A346563C8
Cylance	Unsafe
SentinelOne	Static AI - Malicious PE
Fortinet	PossibleThreat.ZDS
BitDefenderTheta	Gen:NN.ZemsilF.34126.Bm0@aKyap!d
AVG	Win32:CrypterX-gen [Trj]
MaxSecure	Trojan.Malware.300983.susgen

WoodeProcurement_Specification_Doc_Portal2021R3_Client_index.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All