Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 14, 2021, 6:10 p.m.	Nov. 14, 2021, 6:19 p.m.

Size	2.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`fcb63eaba491f872aa88f9ae02f257f9`
SHA256	`2bc3c95726f91e7dbfb361105535d89b9633d67001cb07284f1ea933b6ed8d83`
CRC32	`F288B7F3`
ssdeep	`49152:pOf9j0VFC3VbF4328ht2fjEUMkS4BixpaWbuyuMFoZaQfWYYOu4d:p84sXN8hQJbixpaaXuMCsQJ`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Lazarus_Zero - Lazarus Generic Malware Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file themida_packer - themida packer

7587_1636789492_9651.exe "C:\Users\test22\AppData\Local\Temp\7587_1636789492_9651.exe"
2780

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
45.9.20.149	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 14, 2021, 6:10 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 14, 2021, 6:10 p.m.			0	0
IsDebuggerPresent Nov. 14, 2021, 6:10 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c19e10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c19e10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c19e90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c1a310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c1a350 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c1a350 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c1a810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c1a810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 14, 2021, 6:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c1aa10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 14, 2021, 6:10 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	\xc2\xb0`~\xc2\xa9\6
section	.themida
section	.boot

One or more processes crashed (16 events)

Time & API	Arguments	Status
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 7587_1636789492_9651+0x4bef80 @ 0x5fef80 7587_1636789492_9651+0x4bec76 @ 0x5fec76 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 c4 c3 1d 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 12122088 registers.edi: 2629632 registers.eax: 12122088 registers.ebp: 12122168 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2003530795 registers.ecx: 1894973440	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: ed e9 0e 2a fd ff c3 e9 f0 29 fd ff 64 ff 35 00 exception.symbol: 7587_1636789492_9651+0x4f6071 exception.instruction: in eax, dx exception.module: 7587_1636789492_9651.exe exception.exception_code: 0xc0000096 exception.offset: 5202033 exception.address: 0x636071 registers.esp: 12122208 registers.edi: 4537770 registers.eax: 1750617430 registers.ebp: 2629632 registers.edx: 22614 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: ed e9 9a 46 fd ff 46 f5 28 d1 9b 0a 00 00 00 de exception.symbol: 7587_1636789492_9651+0x4f60a7 exception.instruction: in eax, dx exception.module: 7587_1636789492_9651.exe exception.exception_code: 0xc0000096 exception.offset: 5202087 exception.address: 0x6360a7 registers.esp: 12122208 registers.edi: 4537770 registers.eax: 1447909480 registers.ebp: 2629632 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0xf060e5 0xf05fa2 0xf04fd7 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 13 33 c0 83 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf061ba registers.esp: 12118944 registers.edi: 53620436 registers.eax: 0 registers.ebp: 12118976 registers.edx: 12616040 registers.ebx: 53620372 registers.esi: 53620540 registers.ecx: 0	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0xf0f7c7 0xf0f709 0xf0f3e1 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118636 registers.edi: 56216862 registers.eax: 0 registers.ebp: 12118688 registers.edx: 50874544 registers.ebx: 0 registers.esi: 56216932 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0xf0f7c7 0xf0f709 0xf0f3e1 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118636 registers.edi: 53693686 registers.eax: 0 registers.ebp: 12118688 registers.edx: 50874544 registers.ebx: 0 registers.esi: 53693756 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0xf0f7c7 0xf0f709 0xf0f3e1 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118636 registers.edi: 54745618 registers.eax: 0 registers.ebp: 12118688 registers.edx: 50874544 registers.ebx: 0 registers.esi: 54745688 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3102806 0x3102759 0xf0f483 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118628 registers.edi: 55785462 registers.eax: 0 registers.ebp: 12118680 registers.edx: 50874544 registers.ebx: 0 registers.esi: 55785532 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3102806 0x3102759 0xf0f483 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118628 registers.edi: 56905502 registers.eax: 0 registers.ebp: 12118680 registers.edx: 50874544 registers.ebx: 0 registers.esi: 56905572 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3102806 0x3102759 0xf0f483 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118628 registers.edi: 54244890 registers.eax: 0 registers.ebp: 12118680 registers.edx: 50874544 registers.ebx: 0 registers.esi: 54244960 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3102d35 0x3102c89 0xf0f510 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118632 registers.edi: 55365022 registers.eax: 0 registers.ebp: 12118684 registers.edx: 50874544 registers.ebx: 0 registers.esi: 55365092 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3102d35 0x3102c89 0xf0f510 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118632 registers.edi: 56544050 registers.eax: 0 registers.ebp: 12118684 registers.edx: 50874544 registers.ebx: 0 registers.esi: 56544120 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3102d35 0x3102c89 0xf0f510 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118632 registers.edi: 57723078 registers.eax: 0 registers.ebp: 12118684 registers.edx: 50874544 registers.ebx: 0 registers.esi: 57723148 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3103125 0x3103079 0xf0f581 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118636 registers.edi: 54124986 registers.eax: 0 registers.ebp: 12118688 registers.edx: 50874544 registers.ebx: 0 registers.esi: 54125056 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3103125 0x3103079 0xf0f581 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118636 registers.edi: 55306346 registers.eax: 0 registers.ebp: 12118688 registers.edx: 50874544 registers.ebx: 0 registers.esi: 55306416 registers.ecx: 50880064	1
__exception__ Nov. 14, 2021, 6:10 p.m.	stacktrace: 0x3103125 0x3103079 0xf0f581 0xf0ee7a 0xf09d6a 0xf05025 0xf04d60 0xf0005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 d4 e9 c6 01 00 00 e8 90 2b f2 71 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf0fba5 registers.esp: 12118636 registers.edi: 56487706 registers.eax: 0 registers.ebp: 12118688 registers.edx: 50874544 registers.ebx: 0 registers.esi: 56487776 registers.ecx: 50880064	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 244 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760db000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760db000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bf8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760ce000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76703000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76708000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7675e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76705000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7670c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 14, 2021, 6:10 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data

The binary likely contains encrypted or compressed data indicative of a packer (7 events)

section

{u'size_of_data': u'0x00019400', u'virtual_address': u'0x00002000', u'entropy': 7.978996426597473, u'name': u' ', u'virtual_size': u'0x00032000'}

entropy

7.9789964266

description