Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 15, 2021, 2:27 p.m.	Nov. 15, 2021, 3:04 p.m.

Size	2.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`2855945a6869f6118a4a0bf2c88fd40b`
SHA256	`ee2105a3395dc3eb3c83f9c810ab2bb3c33eb9f688fa9702208c1ab1aa9d7f7e`
CRC32	`0B7DBF98`
ssdeep	`49152:yuiW4q+PkcaiJ++UeLZJnJPf/7oe/xFQomdlPe9U2asyIVE:58tqH+xLbnFfJxNmdlPeq2afIVE`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Lazarus_Zero - Lazarus Generic Malware Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file themida_packer - themida packer

f2_f.exe "C:\Users\test22\AppData\Local\Temp\f2_f.exe"
2784

Name	Response	Post-Analysis Lookup
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.134.233

IP Address	Status	Action
162.159.133.233	Active	Moloch
164.124.101.2	Active	Moloch
86.107.197.248	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 162.159.133.233:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49164 162.159.133.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	54:e1:a7:9d:cc:c8:60:86:f1:a5:da:74:0e:5a:ab:45:df:37:8a:78

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 15, 2021, 2:27 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 15, 2021, 2:27 p.m.			0	0
IsDebuggerPresent Nov. 15, 2021, 2:27 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbeb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002dbeb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 15, 2021, 2:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002db978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 15, 2021, 2:27 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	\xc2\xae\xc2\xb0`~\xc2\xa9
section	.themida
section	.boot

One or more processes crashed (17 events)

Time & API	Arguments	Status
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: f2_f+0x4625aa @ 0x10425aa f2_f+0x4c5edf @ 0x10a5edf exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 42 7d c7 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 2160780 registers.edi: 13770752 registers.eax: 2160780 registers.ebp: 2160860 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2003530795 registers.ecx: 1318191104	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: exception.instruction_r: ed e9 74 c3 ff ff ac 85 d9 af 0a 00 00 00 fe 12 exception.symbol: f2_f+0x50f218 exception.instruction: in eax, dx exception.module: f2_f.exe exception.exception_code: 0xc0000096 exception.offset: 5304856 exception.address: 0x10ef218 registers.esp: 2160900 registers.edi: 15975272 registers.eax: 1750617430 registers.ebp: 13770752 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: exception.instruction_r: ed e9 d3 c0 ff ff c3 e9 93 6a 00 00 75 cf b8 00 exception.symbol: f2_f+0x5190c0 exception.instruction: in eax, dx exception.module: f2_f.exe exception.exception_code: 0xc0000096 exception.offset: 5345472 exception.address: 0x10f90c0 registers.esp: 2160900 registers.edi: 15975272 registers.eax: 1447909480 registers.ebp: 13770752 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x2ab6177 0x2ab5ffc 0x2ab4ec6 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 11 83 3d 5c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2ab620f registers.esp: 2157632 registers.edi: 50963256 registers.eax: 0 registers.ebp: 2157660 registers.edx: 2912608 registers.ebx: 50963256 registers.esi: 50963360 registers.ecx: 0	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0x36dd51 @ 0x721ddd51 mscorlib+0x32fea6 @ 0x7219fea6 mscorlib+0x30ab40 @ 0x7217ab40 0x2abb9a3 0x2abb905 0x2abb486 0x2abaef0 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 42 7d c7 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 2157136 registers.edi: 0 registers.eax: 2157136 registers.ebp: 2157216 registers.edx: 0 registers.ebx: 3616816 registers.esi: 2912608 registers.ecx: 2806585445	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x2abdd87 0x2abdcc9 0x2abd364 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157316 registers.edi: 52389574 registers.eax: 0 registers.ebp: 2157384 registers.edx: 90063908 registers.ebx: 0 registers.esi: 52389644 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x2abdd87 0x2abdcc9 0x2abd364 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157316 registers.edi: 53452542 registers.eax: 0 registers.ebp: 2157384 registers.edx: 90063908 registers.ebx: 0 registers.esi: 53452612 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x2abdd87 0x2abdcc9 0x2abd364 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157316 registers.edi: 54493570 registers.eax: 0 registers.ebp: 2157384 registers.edx: 90063908 registers.ebx: 0 registers.esi: 54493640 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc0d96 0x5fc0ce9 0x2abd406 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157308 registers.edi: 55997034 registers.eax: 0 registers.ebp: 2157376 registers.edx: 90063908 registers.ebx: 0 registers.esi: 55997104 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc0d96 0x5fc0ce9 0x2abd406 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157308 registers.edi: 50400366 registers.eax: 0 registers.ebp: 2157376 registers.edx: 90063908 registers.ebx: 0 registers.esi: 50400436 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc0d96 0x5fc0ce9 0x2abd406 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157308 registers.edi: 51531742 registers.eax: 0 registers.ebp: 2157376 registers.edx: 90063908 registers.ebx: 0 registers.esi: 51531812 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc12b5 0x5fc1209 0x2abd493 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157312 registers.edi: 52652054 registers.eax: 0 registers.ebp: 2157380 registers.edx: 90063908 registers.ebx: 0 registers.esi: 52652124 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc12b5 0x5fc1209 0x2abd493 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157312 registers.edi: 53832126 registers.eax: 0 registers.ebp: 2157380 registers.edx: 90063908 registers.ebx: 0 registers.esi: 53832196 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc12b5 0x5fc1209 0x2abd493 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157312 registers.edi: 55012198 registers.eax: 0 registers.ebp: 2157380 registers.edx: 90063908 registers.ebx: 0 registers.esi: 55012268 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc16a5 0x5fc15f9 0x2abd504 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157316 registers.edi: 51479494 registers.eax: 0 registers.ebp: 2157384 registers.edx: 90063908 registers.ebx: 0 registers.esi: 51479564 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc16a5 0x5fc15f9 0x2abd504 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157316 registers.edi: 52661898 registers.eax: 0 registers.ebp: 2157384 registers.edx: 90063908 registers.ebx: 0 registers.esi: 52661968 registers.ecx: 90069368	1
__exception__ Nov. 15, 2021, 2:27 p.m.	stacktrace: 0x5fc16a5 0x5fc15f9 0x2abd504 0x2abce42 0x2ab98c3 0x2ab4ead 0x2ab4ba0 0x2ab005f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 exception.instruction_r: 8b 40 04 89 45 c4 e9 70 02 00 00 e8 f6 46 37 70 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2abe03f registers.esp: 2157316 registers.edi: 53844302 registers.eax: 0 registers.ebp: 2157384 registers.edx: 90063908 registers.ebx: 0 registers.esi: 53844372 registers.ecx: 90069368	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://cdn.discordapp.com/attachments/688809529202442354/908412484648591370/FULL.exe

Performs some HTTP requests (1 event)

request

GET https://cdn.discordapp.com/attachments/688809529202442354/908412484648591370/FULL.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 245 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7670c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76703000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76708000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7675e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76705000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766fc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7675f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x760cd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 15, 2021, 2:27 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766e4000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 15, 2021, 2:28 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (7 events)

section

{u'size_of_data': u'0x00018c00', u'virtual_address': u'0x00002000', u'entropy': 7.984332716598267, u'name': u' ', u'virtual_size': u'0x00032000'}

entropy

7.9843327166

description