Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 17, 2021, 9:44 a.m.	Sept. 17, 2021, 9:52 a.m.

Size	1011.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`422280cacdf29241ea5342cbf43721d5`
SHA256	`9f3e78d757c1a7fd4f1e00fd68f1f2058d79cb08ae16c8f4dbab6435015dc3c7`
CRC32	`48838226`
ssdeep	`12288:ocVLFvth+w7GodQpbelTclCQUeQyWd2IANlTeulPRDEIteUKt:rvv/Nv+kTBreQyWQIA7Tv/EIwUKt`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

VHGVC-4.exe "C:\Users\test22\AppData\Local\Temp\VHGVC-4.exe"
2332
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2256
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  260
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  1884
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2720
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2880
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  872
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2776
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2740
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  492
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  1276
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2236
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  3020
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2072
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2884
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
  2620
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\VHGVC-4.exe" -Force
  2612

Name	Response	Post-Analysis Lookup
Google.com	A 142.250.66.142	142.250.196.110

IP Address	Status	Action
142.250.66.142	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 128 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 17, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 17, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (18 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:45 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:45 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:45 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:45 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:45 a.m.			0	0
IsDebuggerPresent Sept. 17, 2021, 9:45 a.m.			0	0

Command line console output was observed (50 out of 90 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000033	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x00000037	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: TEST22-PC Google.com 142.250.66.142 {} console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: WARNING: 2 columns do not fit into the display and were removed. console_handle: 0x00000023	1	1
WriteConsoleW Sept. 17, 2021, 9:44 a.m.	buffer: Source Destination IPV4Address IPV6Address console_handle: 0x0000002b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 687 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cff40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0940 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfd80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfd80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfd80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0a00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0a00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06313fa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06317768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06317768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006058a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00606668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00606668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00606668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00606568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00606568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 17, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00606568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 17, 2021, 9:44 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 17, 2021, 9:45 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1 0x684e98 0x684b47 mscorlib+0x2d5861 @ 0x6ff15861 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x357ee CorDllMainForThunk-0x56d0d clr+0xfa867 @ 0x7283a867 DllGetClassObjectInternal+0x358c6 CorDllMainForThunk-0x56c35 clr+0xfa93f @ 0x7283a93f PreBindAssemblyEx+0x107ff StrongNameSignatureVerification-0x174c clr+0x18836a @ 0x728c836a PreBindAssemblyEx+0x10899 StrongNameSignatureVerification-0x16b2 clr+0x188404 @ 0x728c8404 CreateAssemblyNameObject+0x28676 GetMetaDataInternalInterface-0xfdf9 clr+0x55b0f @ 0x72795b0f GetPrivateContextsPerfCounters+0x13ac DllGetActivationFactoryImpl-0x134b9 clr+0x8932e @ 0x727c932e mscorlib+0x2d5eb7 @ 0x6ff15eb7 mscorlib+0x2d5c33 @ 0x6ff15c33 mscorlib+0x2d7894 @ 0x6ff17894 mscorlib+0x2d74ff @ 0x6ff174ff mscorlib+0x2d71c3 @ 0x6ff171c3 mscorlib+0x2d48ea @ 0x6ff148ea mscorlib+0x36990b @ 0x6ffa990b 0x6862a4 0x68584f 0x685790 system+0x1f9799 @ 0x6e899799 system+0x1f92c8 @ 0x6e8992c8 system+0x1eca74 @ 0x6e88ca74 system+0x1ec868 @ 0x6e88c868 system+0x1f82b8 @ 0x6e8982b8 system+0x1ee54d @ 0x6e88e54d system+0x1f70ea @ 0x6e8970ea system+0x1e56c0 @ 0x6e8856c0 system+0x1f8215 @ 0x6e898215 system+0x1f6f75 @ 0x6e896f75 system+0x1ee251 @ 0x6e88e251 system+0x1ee229 @ 0x6e88e229 system+0x1ee170 @ 0x6e88e170 0x4fa08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a system+0x1ebc85 @ 0x6e88bc85 system+0x1f683b @ 0x6e89683b system+0x1e592f @ 0x6e88592f 0x68560e system+0x19c522 @ 0x6e83c522 system+0x19e920 @ 0x6e83e920 system+0x19e803 @ 0x6e83e803 0x6855da system+0x19c522 @ 0x6e83c522 system+0x19e920 @ 0x6e83e920 system+0x19e803 @ 0x6e83e803 0x68515c system+0x1f9799 @ 0x6e899799 system+0x1f92c8 @ 0x6e8992c8 system+0x1eca74 @ 0x6e88ca74 system+0x1ec868 @ 0x6e88c868 system+0x1f82b8 @ 0x6e8982b8 system+0x1ee54d @ 0x6e88e54d system+0x1f70ea @ 0x6e8970ea system+0x1e56c0 @ 0x6e8856c0 system+0x1f8215 @ 0x6e898215 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 4705840 registers.edi: 0 registers.eax: 4705840 registers.ebp: 4705920 registers.edx: 3 registers.ebx: 154541224 registers.esi: 8327552 registers.ecx: 1844545605	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 17, 2021, 9:45 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1
0x684e98
0x684b47
mscorlib+0x2d5861 @ 0x6ff15861
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x357ee CorDllMainForThunk-0x56d0d clr+0xfa867 @ 0x7283a867
DllGetClassObjectInternal+0x358c6 CorDllMainForThunk-0x56c35 clr+0xfa93f @ 0x7283a93f
PreBindAssemblyEx+0x107ff StrongNameSignatureVerification-0x174c clr+0x18836a @ 0x728c836a
PreBindAssemblyEx+0x10899 StrongNameSignatureVerification-0x16b2 clr+0x188404 @ 0x728c8404
CreateAssemblyNameObject+0x28676 GetMetaDataInternalInterface-0xfdf9 clr+0x55b0f @ 0x72795b0f
GetPrivateContextsPerfCounters+0x13ac DllGetActivationFactoryImpl-0x134b9 clr+0x8932e @ 0x727c932e
mscorlib+0x2d5eb7 @ 0x6ff15eb7
mscorlib+0x2d5c33 @ 0x6ff15c33
mscorlib+0x2d7894 @ 0x6ff17894
mscorlib+0x2d74ff @ 0x6ff174ff
mscorlib+0x2d71c3 @ 0x6ff171c3
mscorlib+0x2d48ea @ 0x6ff148ea
mscorlib+0x36990b @ 0x6ffa990b
0x6862a4
0x68584f
0x685790
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215
system+0x1f6f75 @ 0x6e896f75
system+0x1ee251 @ 0x6e88e251
system+0x1ee229 @ 0x6e88e229
system+0x1ee170 @ 0x6e88e170
0x4fa08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
system+0x1ebc85 @ 0x6e88bc85
system+0x1f683b @ 0x6e89683b
system+0x1e592f @ 0x6e88592f
0x68560e
system+0x19c522 @ 0x6e83c522
system+0x19e920 @ 0x6e83e920
system+0x19e803 @ 0x6e83e803
0x6855da
system+0x19c522 @ 0x6e83c522
system+0x19e920 @ 0x6e83e920
system+0x19e803 @ 0x6e83e803
0x68515c
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 4705840
registers.edi: 0
registers.eax: 4705840
registers.ebp: 4705920
registers.edx: 3
registers.ebx: 154541224
registers.esi: 8327552
registers.ecx: 1844545605

Allocates read-write-execute memory (usually to unpack itself) (50 out of 2469 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00681000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00506000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00682000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00683000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00684000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00685000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2021, 9:44 a.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e5c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00686000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00687000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a501000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a504000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a506000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a861000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a86f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2021, 9:45 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a1e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	powershell Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\VHGVC-4.exe" -Force
cmdline	powershell Test-Connection Google.com
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\VHGVC-4.exe" -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\VHGVC-4.exe

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_PingStatus where ((Address='Google.com') And TimeToLive=80 And BufferSize=32)

A process created a hidden window (16 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:44 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:45 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:45 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:45 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:45 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:45 a.m.	show_type: 0 filepath_r: powershell parameters: Test-Connection Google.com filepath: powershell	1	1
ShellExecuteExW Sept. 17, 2021, 9:45 a.m.	show_type: 0 filepath_r: powershell parameters: Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\VHGVC-4.exe" -Force filepath: powershell	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d2600', u'virtual_address': u'0x00002000', u'entropy': 7.2520141954744135, u'name': u'.text', u'virtual_size': u'0x000d2444'}

entropy

7.25201419547

description

A section with a high entropy has been found

entropy

0.83234421365

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (17 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 17, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 17, 2021, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\VHGVC-4.exe

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (50 out of 98 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2332	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2332	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2332	1	0
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 1332 thread_handle: 0x00000334 process_identifier: 2256 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000338	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 1472 thread_handle: 0x000003a8 process_identifier: 260 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003bc	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 2740 thread_handle: 0x000003b0 process_identifier: 1884 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b8	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 2216 thread_handle: 0x000003b4 process_identifier: 2720 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003bc	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 668 thread_handle: 0x000003a8 process_identifier: 2880 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b8	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 2236 thread_handle: 0x000003b0 process_identifier: 872 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003bc	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 2432 thread_handle: 0x000003b4 process_identifier: 2776 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b8	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 1596 thread_handle: 0x000003a0 process_identifier: 2740 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003dc	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 2164 thread_handle: 0x000003b8 process_identifier: 492 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d8	1	1
CreateProcessInternalW Sept. 17, 2021, 9:44 a.m.	thread_identifier: 2692 thread_handle: 0x000003bc process_identifier: 1276 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003dc	1	1
CreateProcessInternalW Sept. 17, 2021, 9:45 a.m.	thread_identifier: 2384 thread_handle: 0x000003a0 process_identifier: 2236 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d8	1	1
CreateProcessInternalW Sept. 17, 2021, 9:45 a.m.	thread_identifier: 2888 thread_handle: 0x00000384 process_identifier: 3020 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003dc	1	1
CreateProcessInternalW Sept. 17, 2021, 9:45 a.m.	thread_identifier: 1684 thread_handle: 0x000003bc process_identifier: 2072 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d8	1	1
CreateProcessInternalW Sept. 17, 2021, 9:45 a.m.	thread_identifier: 2548 thread_handle: 0x000003a0 process_identifier: 2884 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003dc	1	1
CreateProcessInternalW Sept. 17, 2021, 9:45 a.m.	thread_identifier: 240 thread_handle: 0x000003ac process_identifier: 2620 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003a0	1	1
NtResumeThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000003a8 suspend_count: 1 process_identifier: 2332	1	0
NtGetContextThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2332	1	0
NtGetContextThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread Sept. 17, 2021, 9:45 a.m.	registers.eip: 1920740228 registers.esp: 4706048 registers.edi: 140 registers.eax: 10 registers.ebp: 4706072 registers.edx: 38396188 registers.ebx: 127 registers.esi: 37564364 registers.ecx: 137 thread_handle: 0x000000e0 process_identifier: 2332	1	0
NtResumeThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2332	1	0
NtGetContextThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2332	1	0
NtResumeThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000003f4 suspend_count: 1 process_identifier: 2332	1	0
NtResumeThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 2332	1	0
NtResumeThread Sept. 17, 2021, 9:45 a.m.	thread_handle: 0x00000468 suspend_count: 1 process_identifier: 2332	1	0
CreateProcessInternalW Sept. 17, 2021, 9:45 a.m.	thread_identifier: 2560 thread_handle: 0x00000484 process_identifier: 2612 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\test22\AppData\Local\Temp\VHGVC-4.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000049c	1	1
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2256	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2256	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2256	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000005b8 suspend_count: 1 process_identifier: 2256	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 260	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 260	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 260	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000005c0 suspend_count: 1 process_identifier: 260	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000005c8 suspend_count: 1 process_identifier: 1884	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2720	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 2720	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 2720	1	0
NtResumeThread Sept. 17, 2021, 9:44 a.m.	thread_handle: 0x000005c8 suspend_count: 1 process_identifier: 2720	1	0

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Lionic	Trojan.Multi.GenericML.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen14.59459
MicroWorld-eScan	Trojan.GenericKD.37377360
FireEye	Trojan.GenericKD.37377360
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.GenericKD.37377360
Malwarebytes	Malware.AI.1136830318
K7AntiVirus	Trojan ( 0058052d1 )
Alibaba	Trojan:MSIL/Kryptik.f7c23315
K7GW	Trojan ( 0058052d1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D23A5550
BitDefenderTheta	Gen:NN.ZemsilF.34142.@m0@a8MtsN
Cyren	W32/MSIL_Kryptik.FKP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ACEY
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
BitDefender	Trojan.GenericKD.37377360
NANO-Antivirus	Trojan.Win32.Kryptik.iyhgpa
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.GenericKD.37377360
Emsisoft	Trojan.GenericKD.37377360 (B)
F-Secure	Trojan.TR/Kryptik.sdnar
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PH521
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Multi.cly
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.sdnar
MAX	malware (ai score=83)
Antiy-AVL	Trojan/MSIL.Kryptik
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.ns
Microsoft	Trojan:Win32/AgentTesla!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.37377360
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4588850
McAfee	RDN/Generic
VBA32	TScope.Trojan.MSIL
TrendMicro-HouseCall	TROJ_GEN.R002C0PH521
Tencent	Win32.Trojan.Generic.Ozhy
Ikarus	Trojan.MSIL.Krypt
eGambit	Unsafe.AI_Score_90%
Fortinet	MSIL/Kryptik.ACEY!tr

VHGVC-4.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All