Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 5, 2021, 5:39 p.m.	Oct. 5, 2021, 5:41 p.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`83a32d0d136cadf943aa605a7b1e3dc0`
SHA256	`85eb901d5863c16a7526addfb18464967c45348aec3e1d1bf6014958fa4aff8f`
CRC32	`F538BF48`
ssdeep	`12288:6KFJzCCj6OrFr86CDMhz2iNHc1MwJ7D7OYyZUVwaCSxSv7GlaSVX9hF2sweKHHA:Vv16o986CDMhz1Vcn5OY7s+2GlaSiyg`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

DOC20211005-0918629831.exe "C:\Users\test22\AppData\Local\Temp\DOC20211005-0918629831.exe"
2492
- AddInProcess32.exe "C:\Users\test22\AppData\Local\Temp\AddInProcess32.exe"
  2832

Name	Response	Post-Analysis Lookup
www.laliinparfumeri.com	A 185.15.197.14 CNAME laliinparfumeri.com	185.15.197.14
www.pawcomart.com	CNAME pawcomart.com A 34.102.136.180	34.102.136.180
www.164661.com	A 1.32.255.137	1.32.255.137
www.soins-sophro.website	CNAME onstatic-fr.setupdns.net A 81.88.57.68	81.88.57.68
www.sednayachts.com	CNAME sednayachts.com A 34.102.136.180	34.102.136.180
www.google.com	A 172.217.24.68	172.217.174.100
www.englishforbreakfast.com	A 31.11.36.5	31.11.36.5
www.tonesify.com	A 86.105.245.69	86.105.245.69
www.nesboutiqe.com	CNAME nesboutiqe.com A 45.200.120.200	45.200.120.200
www.plataformasoma.net
www.livetvnews24.com	CNAME ghs.google.com A 142.250.66.147	142.251.42.147
www.noalareelecionindefinida.com	CNAME noalareelecionindefinida.com A 182.50.132.242	182.50.132.242
www.survivalfresh.com	A 34.98.99.30 CNAME survivalfresh.com	34.98.99.30
www.lyketigers.com	CNAME lyketigers.com A 34.102.136.180	34.102.136.180
www.aisle5.store	CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
www.growversa.com	CNAME growversa.com A 45.76.85.102	45.76.85.102

IP Address	Status	Action
1.32.255.137	Active	Moloch
142.250.66.147	Active	Moloch
164.124.101.2	Active	Moloch
172.217.24.68	Active	Moloch
182.50.132.242	Active	Moloch
185.15.197.14	Active	Moloch
23.227.38.74	Active	Moloch
31.11.36.5	Active	Moloch
34.102.136.180	Active	Moloch
34.98.99.30	Active	Moloch
45.200.120.200	Active	Moloch
45.76.85.102	Active	Moloch
81.88.57.68	Active	Moloch
86.105.245.69	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 172.217.24.68:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49167 -> 204.79.197.200:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49174 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 34.98.99.30:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 34.98.99.30:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 34.98.99.30:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.15.197.14:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.15.197.14:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.15.197.14:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 182.50.132.242:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 31.11.36.5:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 182.50.132.242:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 182.50.132.242:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 31.11.36.5:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 31.11.36.5:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 81.88.57.68:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 81.88.57.68:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 81.88.57.68:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 142.250.66.147:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 142.250.66.147:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 142.250.66.147:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 1.32.255.137:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 1.32.255.137:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 1.32.255.137:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 45.76.85.102:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 45.76.85.102:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 45.76.85.102:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 45.200.120.200:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 45.200.120.200:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 45.200.120.200:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 86.105.245.69:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 86.105.245.69:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 86.105.245.69:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49165 172.217.24.68:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1C3	CN=www.google.com	81:d3:b1:30:44:e4:01:e1:77:92:f3:6a:43:36:6a:ad:ee:99:4f:36
TLSv1 192.168.56.103:49167 204.79.197.200:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	CN=www.bing.com	af:e3:17:ed:18:4a:d9:1c:24:8a:89:d5:ac:11:b3:27:96:02:37:c8

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 5, 2021, 5:39 p.m.			0	0
IsDebuggerPresent Oct. 5, 2021, 5:39 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 5, 2021, 5:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051f048 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 5, 2021, 5:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051eec8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 5, 2021, 5:39 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051eec8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 5, 2021, 5:39 p.m.		1	1	0

One or more processes crashed (17 events)

Time & API	Arguments	Status
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112024 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43114172 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112140 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43135804 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112256 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43143024 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112372 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43150236 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112488 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43157448 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112604 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43164668 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112720 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43171888 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112836 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43179108 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43112952 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43186328 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43113068 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43193548 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43113184 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43200760 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43113300 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43207972 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43113416 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43215184 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43113532 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43222396 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43113648 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43229616 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43113764 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43236836 registers.ecx: 1914981678	1
__exception__ Oct. 5, 2021, 5:39 p.m.	stacktrace: 0x882774 0x88253d 0x8804d8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 95 c0 0f b6 c0 89 45 c4 83 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x883419 registers.esp: 4125668 registers.edi: 43113880 registers.eax: 0 registers.ebp: 4125764 registers.edx: 0 registers.ebx: 43114876 registers.esi: 43244056 registers.ecx: 1914981678	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (16 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.nesboutiqe.com/ntfs/?AjR=0AZpuU1lOai/c3CFYAglV3LWApx0HI/ymZlC3B0dBStOc3qSnIN3lUvYiRyaPsUKmnHjuct2&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.soins-sophro.website/ntfs/?AjR=kF66ll0Um1jo8iklno67xUTptp8D/61uY/Y7h45ITxQ0tPbmVeSluOpT2Cq4/G4DLgLc5y45&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.aisle5.store/ntfs/?AjR=JiVfHxsQIUZIVOrZdasW0XDgZGDHbuQkpfVpZdXmV082HGIoqOCfLlCi+Z81v5cq8/OBmvs4&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.englishforbreakfast.com/ntfs/?AjR=3i72MLA1eJ23KItbm1vJ6YRASBd+2eIAAK9eDTlV/1BpCv8kby1iQl4I3Y535oeWZTKakmdB&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.survivalfresh.com/ntfs/?AjR=21tLgbP2yagke5ca39MMCkaTw3ul+25tQiZH/vehq0MisVUMvB6xQMdWVewG09mnNKvW1Jqi&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.growversa.com/ntfs/?AjR=77KnmNOuKLtpENzAkQuq2gNmvUW4CHqnjVAqaPll/fIdfZHCrb/Qpm1ltv8IJzs1z9eKUWdP&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.lyketigers.com/ntfs/?AjR=GAYoP5SBXtEJMk1r7XxckxlvOWPYxqX0P7cMtyu4khc4paR1vfQmhhKA4Vf/9ulLTXCCdtNN&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.livetvnews24.com/ntfs/?AjR=WWBf0ejULkkWCGhGgTCASpPE+YBI6b/V2JT0klCOaSo8CpBxqsqIUL1am+XWR9RFDjFFrYDz&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.164661.com/ntfs/?AjR=EQGFpvzmjJ01FBcJ82kVFjhH2vYYK8cPxl1D6Cz1nlh+Zn0dJbcoKaYC/GcRTMOob/2YoFxj&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.pawcomart.com/ntfs/?AjR=+h+pxPcrngPOC8DSeBps7fK+M6H9abOtW9PHZY+UHB6fdPPxF9r9GWz81ir9o9+4HBhkJXpk&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.laliinparfumeri.com/ntfs/?AjR=659NitD4XNMpAA5H+/pz8DnE6u+OgBpPVYj1y9JqI+QCevyhn+u5eqFdNfdyGPZBpQ3K+5wu&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.tonesify.com/ntfs/?AjR=XayKz9N33Y7MmipE5fqv+pwyVwXNcPO1Ok9qLtTzsjUVdppRPVF79P0o009gNfu+TLiF4Hsh&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.noalareelecionindefinida.com/ntfs/?AjR=dYZXaQ1KnAs1iIfz+GCmlR8GbRfWCjtzJ+9RQt2hFNiEXT8n/q07/spfuGdSq2ifGUCapvn7&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.sednayachts.com/ntfs/?AjR=yWWLGy5N757qGygxfTz2VpgR61VSaqzwvTV90moS0mb9EpVeiTqg4EAujagaLLOCRusgD2OW&ndndsT=KdvDIh08e8D4
suspicious_features	GET method with no useragent header	suspicious_request	GET https://www.google.com/
suspicious_features	GET method with no useragent header	suspicious_request	GET https://www.bing.com/

Performs some HTTP requests (16 events)

request	GET http://www.nesboutiqe.com/ntfs/?AjR=0AZpuU1lOai/c3CFYAglV3LWApx0HI/ymZlC3B0dBStOc3qSnIN3lUvYiRyaPsUKmnHjuct2&ndndsT=KdvDIh08e8D4
request	GET http://www.soins-sophro.website/ntfs/?AjR=kF66ll0Um1jo8iklno67xUTptp8D/61uY/Y7h45ITxQ0tPbmVeSluOpT2Cq4/G4DLgLc5y45&ndndsT=KdvDIh08e8D4
request	GET http://www.aisle5.store/ntfs/?AjR=JiVfHxsQIUZIVOrZdasW0XDgZGDHbuQkpfVpZdXmV082HGIoqOCfLlCi+Z81v5cq8/OBmvs4&ndndsT=KdvDIh08e8D4
request	GET http://www.englishforbreakfast.com/ntfs/?AjR=3i72MLA1eJ23KItbm1vJ6YRASBd+2eIAAK9eDTlV/1BpCv8kby1iQl4I3Y535oeWZTKakmdB&ndndsT=KdvDIh08e8D4
request	GET http://www.survivalfresh.com/ntfs/?AjR=21tLgbP2yagke5ca39MMCkaTw3ul+25tQiZH/vehq0MisVUMvB6xQMdWVewG09mnNKvW1Jqi&ndndsT=KdvDIh08e8D4
request	GET http://www.growversa.com/ntfs/?AjR=77KnmNOuKLtpENzAkQuq2gNmvUW4CHqnjVAqaPll/fIdfZHCrb/Qpm1ltv8IJzs1z9eKUWdP&ndndsT=KdvDIh08e8D4
request	GET http://www.lyketigers.com/ntfs/?AjR=GAYoP5SBXtEJMk1r7XxckxlvOWPYxqX0P7cMtyu4khc4paR1vfQmhhKA4Vf/9ulLTXCCdtNN&ndndsT=KdvDIh08e8D4
request	GET http://www.livetvnews24.com/ntfs/?AjR=WWBf0ejULkkWCGhGgTCASpPE+YBI6b/V2JT0klCOaSo8CpBxqsqIUL1am+XWR9RFDjFFrYDz&ndndsT=KdvDIh08e8D4
request	GET http://www.164661.com/ntfs/?AjR=EQGFpvzmjJ01FBcJ82kVFjhH2vYYK8cPxl1D6Cz1nlh+Zn0dJbcoKaYC/GcRTMOob/2YoFxj&ndndsT=KdvDIh08e8D4
request	GET http://www.pawcomart.com/ntfs/?AjR=+h+pxPcrngPOC8DSeBps7fK+M6H9abOtW9PHZY+UHB6fdPPxF9r9GWz81ir9o9+4HBhkJXpk&ndndsT=KdvDIh08e8D4
request	GET http://www.laliinparfumeri.com/ntfs/?AjR=659NitD4XNMpAA5H+/pz8DnE6u+OgBpPVYj1y9JqI+QCevyhn+u5eqFdNfdyGPZBpQ3K+5wu&ndndsT=KdvDIh08e8D4
request	GET http://www.tonesify.com/ntfs/?AjR=XayKz9N33Y7MmipE5fqv+pwyVwXNcPO1Ok9qLtTzsjUVdppRPVF79P0o009gNfu+TLiF4Hsh&ndndsT=KdvDIh08e8D4
request	GET http://www.noalareelecionindefinida.com/ntfs/?AjR=dYZXaQ1KnAs1iIfz+GCmlR8GbRfWCjtzJ+9RQt2hFNiEXT8n/q07/spfuGdSq2ifGUCapvn7&ndndsT=KdvDIh08e8D4
request	GET http://www.sednayachts.com/ntfs/?AjR=yWWLGy5N757qGygxfTz2VpgR61VSaqzwvTV90moS0mb9EpVeiTqg4EAujagaLLOCRusgD2OW&ndndsT=KdvDIh08e8D4
request	GET https://www.google.com/
request	GET https://www.bing.com/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 88 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bd1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bd2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00881000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00882000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00883000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00884000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00885000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b4f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00886000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00887000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00888000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00611000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00889000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 15872 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab0400 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab0178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05ab01a0 process_handle: 0xffffffff		3221225550

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 5, 2021, 5:39 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 5, 2021, 5:39 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Oct. 5, 2021, 5:39 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2832 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000023c	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Oct. 5, 2021, 5:39 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

DOC20211005-0918629831.exe tried to sleep 5456343 seconds, actually delayed analysis time by 5456343 seconds

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 5, 2021, 5:39 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL\¬DCà \|PÔ@@.textl{\| ` base_address: 0x00400000 process_identifier: 2832 process_handle: 0x0000023c	1	1	0
WriteProcessMemory Oct. 5, 2021, 5:39 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2832 process_handle: 0x0000023c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 5, 2021, 5:39 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL\¬DCà \|PÔ@@.textl{\| ` base_address: 0x00400000 process_identifier: 2832 process_handle: 0x0000023c	1	1	0

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Elastic	malicious (high confidence)
McAfee	AgentTesla-FDAK!83A32D0D136C
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
Cyren	W32/MSIL_Kryptik.ANN.gen!Eldorado
Symantec	Packed.Generic.619
APEX	Malicious
McAfee-GW-Edition	BehavesLike.Win32.Fareit.th
FireEye	Generic.mg.83a32d0d136cadf9
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
Malwarebytes	Trojan.MZCrypt.MSIL.Generic
Ikarus	Trojan-Spy.HawkEye
Fortinet	MSIL/Kryptik.ACYK!tr
BitDefenderTheta	Gen:NN.ZemsilF.34170.cn0@a87vJXh
Cybereason	malicious.6499be

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2492 called NtSetContextThread to modify thread in remote process 2832
NtSetContextThread Oct. 5, 2021, 5:39 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4314192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000234 process_identifier: 2832	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\DOC20211005-0918629831.exe\:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2492 resumed a thread in remote process 2832
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2832	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2492	1	0
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2492	1	0
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2492	1	0
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000348 suspend_count: 1 process_identifier: 2492	1	0
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000610 suspend_count: 1 process_identifier: 2492	1	0
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000634 suspend_count: 1 process_identifier: 2492	1	0
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2492	1	0
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2492	1	0
CreateProcessInternalW Oct. 5, 2021, 5:39 p.m.	thread_identifier: 2812 thread_handle: 0x00000234 process_identifier: 2832 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\AddInProcess32.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\AddInProcess32.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\AddInProcess32.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000023c	1	1
NtGetContextThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000234	1	0
NtAllocateVirtualMemory Oct. 5, 2021, 5:39 p.m.	process_identifier: 2832 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000023c	1	0
WriteProcessMemory Oct. 5, 2021, 5:39 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL\¬DCà \|PÔ@@.textl{\| ` base_address: 0x00400000 process_identifier: 2832 process_handle: 0x0000023c	1	1
WriteProcessMemory Oct. 5, 2021, 5:39 p.m.	buffer: base_address: 0x00401000 process_identifier: 2832 process_handle: 0x0000023c	1	1
WriteProcessMemory Oct. 5, 2021, 5:39 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2832 process_handle: 0x0000023c	1	1
NtSetContextThread Oct. 5, 2021, 5:39 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4314192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000234 process_identifier: 2832	1	0
NtResumeThread Oct. 5, 2021, 5:39 p.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2832	1	0

DOC20211005-0918629831.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All