Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 12, 2021, 2:45 p.m.	Sept. 12, 2021, 2:57 p.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f1f7b6d3bc2c2d4c5b673d6fdcbdf04f`
SHA256	`c0ead704ef1d5b9a6d60c2c3ad3b68a95a0e4dbef4f0a6fa2a477cde84d461c7`
CRC32	`77198B9E`
ssdeep	`24576:Bb2LpXk+b6umJBDAJeqtgq0RF8mvhH0HDEZo9aGCii0wY:ELfqBDAfgfR+ml0HDEZCaGCiie`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

qtl_000027401622208.exe "C:\Users\test22\AppData\Local\Temp\qtl_000027401622208.exe"
1092
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  1460
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  972
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2320
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2400
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  1972
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2340
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2752
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  2916
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  928
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
  456
- qtl_000027401622208.exe C:\Users\test22\AppData\Local\Temp\qtl_000027401622208.exe
  1052

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 61 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 12, 2021, 2:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 12, 2021, 2:46 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (12 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:45 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:46 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:46 p.m.			0	0
IsDebuggerPresent Sept. 12, 2021, 2:46 p.m.			0	0

Command line console output was observed (50 out of 80 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: The term 'Test-NetConnection' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: ath was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + Test-NetConnection <<<< console_handle: 0x00000053	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Test-NetConnection:String) [], console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: CommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: The term 'Test-NetConnection' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: ath was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + Test-NetConnection <<<< console_handle: 0x00000053	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Test-NetConnection:String) [], console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: CommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: The term 'Test-NetConnection' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: ath was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + Test-NetConnection <<<< console_handle: 0x00000053	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Test-NetConnection:String) [], console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: CommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: The term 'Test-NetConnection' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: ath was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + Test-NetConnection <<<< console_handle: 0x00000053	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Test-NetConnection:String) [], console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: CommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: The term 'Test-NetConnection' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: ath was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + Test-NetConnection <<<< console_handle: 0x00000053	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Test-NetConnection:String) [], console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: CommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: The term 'Test-NetConnection' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: ath was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: At line:1 char:19 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + Test-NetConnection <<<< console_handle: 0x00000053	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Test-NetConnection:String) [], console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: CommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 12, 2021, 2:45 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 12, 2021, 2:46 p.m.	buffer: The term 'Test-NetConnection' is not recognized as the name of a cmdlet, functi console_handle: 0x00000023	1	1
WriteConsoleW Sept. 12, 2021, 2:46 p.m.	buffer: on, script file, or operable program. Check the spelling of the name, or if a p console_handle: 0x0000002f	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 463 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 12, 2021, 2:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00382970 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00382fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00382fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00724058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723d98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723b58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723f98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00723e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007235d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007235d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007235d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007235d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007235d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007235d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007235d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007235d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 12, 2021, 2:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004332c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 12, 2021, 2:45 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 12, 2021, 2:46 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e 0x77c754d 0x77c74c2 0x77c5184 0x77c4463 0x793e58e 0x74400cf system+0x1d3f63 @ 0x70073f63 0xab8951 0xab8753 system+0x1f9799 @ 0x70c99799 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x57a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a system+0x1ebc85 @ 0x70c8bc85 system+0x1f683b @ 0x70c9683b system+0x1a5e44 @ 0x70c45e44 system+0x1fd8a0 @ 0x70c9d8a0 system+0x1fd792 @ 0x70c9d792 system+0x1a14bd @ 0x70c414bd 0xab00a2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x76a6b479 registers.esp: 2155728 registers.edi: 1969676232 registers.eax: 19202048 registers.ebp: 2155932 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1	0	0
__exception__ Sept. 12, 2021, 2:46 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 2289940 registers.edi: 6241440 registers.eax: 2289940 registers.ebp: 2290020 registers.edx: 0 registers.ebx: 6241440 registers.esi: 6241440 registers.ecx: 2	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 12, 2021, 2:46 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e
0x77c754d
0x77c74c2
0x77c5184
0x77c4463
0x793e58e
0x74400cf
system+0x1d3f63 @ 0x70073f63
0xab8951
0xab8753
system+0x1f9799 @ 0x70c99799
system+0x1f92c8 @ 0x70c992c8
system+0x1eca74 @ 0x70c8ca74
system+0x1ec868 @ 0x70c8c868
system+0x1f82b8 @ 0x70c982b8
system+0x1ee54d @ 0x70c8e54d
system+0x1f70ea @ 0x70c970ea
system+0x1e56c0 @ 0x70c856c0
system+0x1f8215 @ 0x70c98215
system+0x1f6f75 @ 0x70c96f75
system+0x1ee251 @ 0x70c8e251
system+0x1ee229 @ 0x70c8e229
system+0x1ee170 @ 0x70c8e170
0x57a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a
system+0x1ebc85 @ 0x70c8bc85
system+0x1f683b @ 0x70c9683b
system+0x1a5e44 @ 0x70c45e44
system+0x1fd8a0 @ 0x70c9d8a0
system+0x1fd792 @ 0x70c9d792
system+0x1a14bd @ 0x70c414bd
0xab00a2
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x76a6b479
registers.esp: 2155728
registers.edi: 1969676232
registers.eax: 19202048
registers.ebp: 2155932
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

Sept. 12, 2021, 2:46 p.m.

stacktrace:

EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7566b727
registers.esp: 2289940
registers.edi: 6241440
registers.eax: 2289940
registers.ebp: 2290020
registers.edx: 0
registers.ebx: 6241440
registers.esi: 6241440
registers.ecx: 2

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1412 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70692000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00abc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07931000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07938000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0793d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0793e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0744f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07440000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0793f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eca1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eca2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02082000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 12, 2021, 2:45 p.m.	process_identifier: 1460 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
cmdline	powershell Test-NetConnection

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_ComputerSystem

A process created a hidden window (10 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 12, 2021, 2:45 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:45 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:45 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:45 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:45 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:45 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:45 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:46 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:46 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1
ShellExecuteExW Sept. 12, 2021, 2:46 p.m.	show_type: 0 filepath_r: powershell parameters: Test-NetConnection filepath: powershell	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00122600', u'virtual_address': u'0x00002000', u'entropy': 7.462297375958887, u'name': u'.text', u'virtual_size': u'0x00122454'}

entropy

7.46229737596

description

A section with a high entropy has been found

entropy

0.87759727994

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (11 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 12, 2021, 2:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:46 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:46 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 12, 2021, 2:46 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (19 events)

url	http://crl4.digicert.com/sha2-assured-ts.crl0
url	http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
url	http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
url	https://www.nuget.org/packages/Newtonsoft.Json.Bson
url	http://ocsp.digicert.com0O
url	http://ocsp.digicert.com0K
url	http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
url	http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
url	http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
url	https://www.newtonsoft.com/jsonschema
url	http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
url	http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
url	https://www.newtonsoft.com/json
url	http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
url	http://ocsp.digicert.com0N
url	http://ocsp.digicert.com0C
url	http://crl3.digicert.com/sha2-assured-ts.crl02
url	https://www.digicert.com/CPS0
url	http://www.digicert.com/CPS0

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vba
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	Select * from Win32_ComputerSystem

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 06eedf773d2c5001b8b0364f8901eff49f20399b
buffer	Buffer with sha1: 380398c504bccc7c558ee875277638ab4e1a3cde

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1052 region_size: 499712 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000404	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\word

reg_value

"C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\office\word.exe"

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 12, 2021, 2:46 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1052 process_handle: 0x00000404	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1092 called NtSetContextThread to modify thread in remote process 1052
NtSetContextThread Sept. 12, 2021, 2:46 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4204760 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000408 process_identifier: 1052	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1092 resumed a thread in remote process 1052
NtResumeThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x00000408 suspend_count: 1 process_identifier: 1052	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (50 out of 70 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1092	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 1092	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1092	1	0
CreateProcessInternalW Sept. 12, 2021, 2:45 p.m.	thread_identifier: 2104 thread_handle: 0x000003cc process_identifier: 1460 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003c8	1	1
CreateProcessInternalW Sept. 12, 2021, 2:45 p.m.	thread_identifier: 2848 thread_handle: 0x000003f0 process_identifier: 972 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000040c	1	1
CreateProcessInternalW Sept. 12, 2021, 2:45 p.m.	thread_identifier: 2316 thread_handle: 0x000003fc process_identifier: 2320 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000408	1	1
CreateProcessInternalW Sept. 12, 2021, 2:45 p.m.	thread_identifier: 2292 thread_handle: 0x00000404 process_identifier: 2400 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000040c	1	1
CreateProcessInternalW Sept. 12, 2021, 2:45 p.m.	thread_identifier: 3008 thread_handle: 0x000003f0 process_identifier: 1972 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000408	1	1
CreateProcessInternalW Sept. 12, 2021, 2:45 p.m.	thread_identifier: 248 thread_handle: 0x000003f8 process_identifier: 2340 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000420	1	1
CreateProcessInternalW Sept. 12, 2021, 2:45 p.m.	thread_identifier: 2524 thread_handle: 0x000003f0 process_identifier: 2752 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000040c	1	1
CreateProcessInternalW Sept. 12, 2021, 2:46 p.m.	thread_identifier: 2104 thread_handle: 0x00000408 process_identifier: 2916 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000420	1	1
CreateProcessInternalW Sept. 12, 2021, 2:46 p.m.	thread_identifier: 1792 thread_handle: 0x000003f8 process_identifier: 928 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000040c	1	1
CreateProcessInternalW Sept. 12, 2021, 2:46 p.m.	thread_identifier: 2920 thread_handle: 0x000003f0 process_identifier: 456 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000420	1	1
NtResumeThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x000003fc suspend_count: 1 process_identifier: 1092	1	0
NtGetContextThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1092	1	0
NtGetContextThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1092	1	0
CreateProcessInternalW Sept. 12, 2021, 2:46 p.m.	thread_identifier: 2100 thread_handle: 0x00000408 process_identifier: 1052 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\qtl_000027401622208.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000404	1	1
NtGetContextThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x00000408	1	0
NtAllocateVirtualMemory Sept. 12, 2021, 2:46 p.m.	process_identifier: 1052 region_size: 499712 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000404	1	0
WriteProcessMemory Sept. 12, 2021, 2:46 p.m.	buffer: base_address: 0x00400000 process_identifier: 1052 process_handle: 0x00000404	1	1
WriteProcessMemory Sept. 12, 2021, 2:46 p.m.	buffer: base_address: 0x00401000 process_identifier: 1052 process_handle: 0x00000404	1	1
WriteProcessMemory Sept. 12, 2021, 2:46 p.m.	buffer: base_address: 0x0041f000 process_identifier: 1052 process_handle: 0x00000404	1	1
WriteProcessMemory Sept. 12, 2021, 2:46 p.m.	buffer: base_address: 0x00420000 process_identifier: 1052 process_handle: 0x00000404	1	1
WriteProcessMemory Sept. 12, 2021, 2:46 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1052 process_handle: 0x00000404	1	1
NtSetContextThread Sept. 12, 2021, 2:46 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4204760 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000408 process_identifier: 1052	1	0
NtResumeThread Sept. 12, 2021, 2:46 p.m.	thread_handle: 0x00000408 suspend_count: 1 process_identifier: 1052	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x00000438 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x00000498 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 972	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 972	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 972	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 972	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2320	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2320	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2320	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2320	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002f4 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 1972	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 1972	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 1972	1	0
NtResumeThread Sept. 12, 2021, 2:45 p.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 1972	1	0

qtl_000027401622208.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All