Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 20, 2022, 9:53 a.m.	Jan. 20, 2022, 10 a.m.

Size	172.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`af4fc86d0d07bba1b5ca1f0a7014504e`
SHA256	`f861b22de2dce92e689b895e8b862fe51bfab56cf466db8d1ea7513682cd3c36`
CRC32	`28CDA04E`
ssdeep	`768:b7DdimsaYPtSHPWcmhVm13jPJXt9qoST/p80yX6moPCdj0V:vDdimpG/p80yX6moP+j0V`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

9678012459.exe "C:\Users\test22\AppData\Local\Temp\9678012459.exe"
2796
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\qs5ycixe1cg.vbs"
  2296
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "C:\Users\test22\AppData\Local\Temp\Bvekhpeqvyrnrcffile.pdf"
    2452
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef4b0f1e8,0x7fef4b0f1f8,0x7fef4b0f208
      2592
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2496 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
      2792
- 9678012459.exe C:\Users\test22\AppData\Local\Temp\9678012459.exe
  2416

Name	Response	Post-Analysis Lookup
noithatcombo.com.vn	A 103.221.222.30	103.221.222.30
trietlongvinhvien.info	A 150.95.104.46	150.95.104.46

IP Address	Status	Action
103.221.222.30	Active	Moloch
150.95.104.46	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 20, 2022, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 20, 2022, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 20, 2022, 9:54 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (37 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 20, 2022, 9:53 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:53 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:54 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:54 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:54 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:55 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:54 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:54 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:54 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:54 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 20, 2022, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007053a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007053a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00705428 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00705428 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00705428 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00705568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe\PATH
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 20, 2022, 9:53 a.m.		1	1	0

One or more processes crashed (5 events)

Time & API	Arguments	Status
__exception__ Jan. 20, 2022, 9:54 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x5cc4b98 0x5cc30e7 0x5cc0f46 0x5cc0e0a 0x5678aa DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x5602aa 0x560117 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 CopyPDBs+0x4c45 DllCanUnloadNowInternal-0x3c392 clr+0x19a887 @ 0x72fca887 DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3334648 registers.edi: 1980555208 registers.eax: 16777216 registers.ebp: 3334852 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Jan. 20, 2022, 9:54 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x5cc4b98 0x5cc30e7 0x5cc0f46 0x5cc0e0a 0x5678aa DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x5602aa 0x560117 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 CopyPDBs+0x4c45 DllCanUnloadNowInternal-0x3c392 clr+0x19a887 @ 0x72fca887 DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3334648 registers.edi: 1980555208 registers.eax: 4194304 registers.ebp: 3334852 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Jan. 20, 2022, 9:54 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x5cc4b98 0x5cc30e7 0x5cc0f46 0x5cc0e0a 0x5678aa DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x5602aa 0x560117 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 CopyPDBs+0x4c45 DllCanUnloadNowInternal-0x3c392 clr+0x19a887 @ 0x72fca887 DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3334648 registers.edi: 1980555208 registers.eax: 14548992 registers.ebp: 3334852 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Jan. 20, 2022, 9:54 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x5cc4b98 0x5cc30e7 0x5cc0f46 0x5cc0e0a 0x5678aa DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x5602aa 0x560117 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 CopyPDBs+0x4c45 DllCanUnloadNowInternal-0x3c392 clr+0x19a887 @ 0x72fca887 DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3334648 registers.edi: 1980555208 registers.eax: 5373952 registers.ebp: 3334852 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Jan. 20, 2022, 9:55 a.m.	stacktrace: 0x1d52e04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 f8 76 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1d52e04 registers.r14: 185527472 registers.r15: 185527912 registers.rcx: 1420 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 53791360 registers.rsp: 185526648 registers.r11: 185531168 registers.r8: 2002289036 registers.r9: 0 registers.rdx: 1508 registers.r12: 32028160 registers.rbp: 185526784 registers.rdi: 32027904 registers.rax: 30748160 registers.r13: 185527344	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://trietlongvinhvien.info//.tmb/ID4/9678012459.jpeg
suspicious_features	POST method with no referer header, HTTP version 1.0 used				suspicious_request	POST http://noithatcombo.com.vn/.mbc/need/work/Panel/five/fre.php

Performs some HTTP requests (2 events)

request	GET http://trietlongvinhvien.info//.tmb/ID4/9678012459.jpeg
request	POST http://noithatcombo.com.vn/.mbc/need/work/Panel/five/fre.php

Sends data using the HTTP POST Method (1 event)

request

POST http://noithatcombo.com.vn/.mbc/need/work/Panel/five/fre.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 66 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:53 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00561000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0439f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00563000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00564000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00566000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00568000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00569000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 2452 crashed
__exception__ Jan. 20, 2022, 9:55 a.m.	stacktrace: 0x1d52e04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 f8 76 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1d52e04 registers.r14: 185527472 registers.r15: 185527912 registers.rcx: 1420 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 53791360 registers.rsp: 185526648 registers.r11: 185531168 registers.r8: 2002289036 registers.r9: 0 registers.rdx: 1508 registers.r12: 32028160 registers.rbp: 185526784 registers.rdi: 32027904 registers.rax: 30748160 registers.r13: 185527344	1	0	0

Steals private information from local Internet browsers (50 out of 57 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\4216970f-51c1-49f8-8cfa-1d881461b6dc.dmp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Prefix Set
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing IP Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61E8EFD4-994.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Module Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Side-Effect Free Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List Prefix Set
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Inclusion Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Csd Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Extension Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Resource Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Stability\2452-1642640093312500.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\AnyIpMalware.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5F2CDF32-998.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\Bvekhpeqvyrnrcffile.pdf

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\qs5ycixe1cg.vbs

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\qs5ycixe1cg.vbs
file	C:\Users\test22\AppData\Local\Temp\Bvekhpeqvyrnrcffile.pdf

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW Jan. 20, 2022, 9:54 a.m.	newfilepath_r: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe flags: 1 oldfilepath_r: C:\Users\test22\AppData\Local\Temp\9678012459.exe newfilepath: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe oldfilepath: C:\Users\test22\AppData\Local\Temp\9678012459.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Jan. 20, 2022, 9:54 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 20, 2022, 9:54 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Jan. 20, 2022, 9:54 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 1082 events)

url	http://www.ibsensoftware.com/
url	https://clients4.google.com/invalidation/android/request/
url	http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
url	http://services.ukrposhta.com/postindex_new/
url	http://dts.search-results.com/sr?lng=
url	http://inposdom.gob.do/codigo-postal/
url	http://creativecommons.org/ns
url	http://www.postur.fo/
url	https://qc.search.yahoo.com/search?ei=
url	https://cacert.omniroot.com/baltimoreroot.crt09
url	https://codereview.chromium.org/25305002).
url	https://search.yahoo.com/search?ei=
url	http://t1.symcb.com/ThawtePCA.crl0/
url	http://crbug.com/31395.
url	https://support.google.com/chrome/answer/165139
url	https://ct.googleapis.com/aviator/
url	http://crl.starfieldtech.com/sfroot-g2.crl0L
url	https://ct.startssl.com/
url	https://suggest.yandex.com.tr/suggest-ff.cgi?part=
url	https://de.search.yahoo.com/favicon.ico
url	https://github.com/GoogleChrome/Lighthouse/issues
url	http://www.searchnu.com/favicon.ico
url	https://support.google.com/installer/?product=
url	http://msdn.microsoft.com/en-us/library/ms792901.aspx
url	https://www.najdi.si/search.jsp?q=
url	http://x.ss2.us/x.cer0
url	http://crl.geotrust.com/crls/gtglobal.crl04
url	https://accounts.google.com/ServiceLogin
url	https://accounts.google.com/OAuthLogin
url	https://search.goo.ne.jp/sgt.jsp?MT=
url	https://www.google.com/tools/feedback/chrome/__submit
url	https://chrome.google.com/webstore/category/collection/dark_themes
url	http://ocsp.starfieldtech.com/08
url	http://www.guernseypost.com/postcode_finder/
url	http://crl.certum.pl/ca.crl0h
url	http://ator
url	https://suggest.yandex.by/suggest-ff.cgi?part=
url	http://feed.snap.do/?q=
url	https://sp.uk.ask.com/sh/i/a16/favicon/favicon.ico
url	http://www.language
url	https://support.google.com/chrome/
url	http://developer.chrome.com/apps/declare_permissions.html
url	http://www.google.com/chrome/intl/ko/eula_text.html
url	https://www.globalsign.com/repository/03
url	http://www.startssl.com/sfsca.crl0
url	http://UA-Compatible
url	https://se.search.yahoo.com/search?ei=
url	http://EVSecure-ocsp.geotrust.com0
url	https://developers.google.com/web/fundamentals/accessibility/accessible-styles
url	https://mammoth.ct.comodo.com/

Yara rule detected in process memory (50 out of 1379 events)

description	Communications use DNS	rule	Network_DNS
description	Win32 PWS Loki	rule	Win32_PWS_Loki_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	browser info stealer	rule	infoStealer_browser_Zero
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Virtual currency	rule	Virtual_currency_Zero
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Perform crypto currency mining	rule	BitCoin
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Jan. 20, 2022, 9:55 a.m.	status_code: 0xc0000005 process_identifier: 2452 process_handle: 0x0000000000000094		0	0
NtTerminateProcess Jan. 20, 2022, 9:55 a.m.	status_code: 0xc0000005 process_identifier: 2452 process_handle: 0x0000000000000094	1	0	0

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2416 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003a4	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\update

reg_value

"C:\Users\test22\AppData\Roaming\update\update.exe"

Harvests credentials from local FTP client softwares (22 events)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\test22\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2416 process_handle: 0x000003a4	1	1
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: TÍ<¨K¢`Ý;U base_address: 0x0041a000 process_identifier: 2416 process_handle: 0x000003a4	1	1
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2416 process_handle: 0x000003a4	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2416 process_handle: 0x000003a4	1	1	0

Harvests credentials from local email clients (3 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2796 called NtSetContextThread to modify thread in remote process 2416
NtSetContextThread Jan. 20, 2022, 9:54 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000504 process_identifier: 2416	1	0	0

One or more non-whitelisted processes were created (5 events)

parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef4b0f1e8,0x7fef4b0f1f8,0x7fef4b0f208
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1264,14278984462910021065,14971354701281110303,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=E177664F63EB3069B35A11E6E6F0425B --mojo-platform-channel-handle=1280 --ignored=" --type=renderer " /prefetch:2
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2496 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
parent_process	wscript.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "C:\Users\test22\AppData\Local\Temp\Bvekhpeqvyrnrcffile.pdf"
parent_process	wscript.exe	martian_process	C:\Users\test22\AppData\Local\Temp\Bvekhpeqvyrnrcffile.pdf

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (1 event)

url	http://127.0.0.1

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (40 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2796 resumed a thread in remote process 2416
Process injection	Process 2592 resumed a thread in remote process 2452
NtResumeThread Jan. 20, 2022, 9:54 a.m.	thread_handle: 0x00000504 suspend_count: 1 process_identifier: 2416	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Strictor.267735
FireEye	Generic.mg.af4fc86d0d07bba1
Malwarebytes	Trojan.Downloader
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/Faker.Q.gen!Eldorado
ESET-NOD32	a variant of MSIL/GenKryptik.FPYG
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Remcos.gen
Avast	Win32:MalwareX-gen [Trj]
Emsisoft	Gen:Variant.Strictor.267735 (B)
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Cynet	Malicious (score: 100)
McAfee	Artemis!AF4FC86D0D07
MAX	malware (ai score=84)
Rising	Malware.Obfus/MSIL@AI.90 (RDM.MSIL:eno83vFk2SpgEdhoIX7SEQ)
Fortinet	W32/Agent.KAD!tr
AVG	Win32:MalwareX-gen [Trj]

Executed a process and injected code into it, probably while unpacking (50 out of 98 events)

Time & API	Arguments	Status	Return
NtResumeThread Jan. 20, 2022, 9:53 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2796	1	0
NtResumeThread Jan. 20, 2022, 9:53 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2796	1	0
NtResumeThread Jan. 20, 2022, 9:53 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2796	1	0
NtResumeThread Jan. 20, 2022, 9:54 a.m.	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 2796	1	0
NtResumeThread Jan. 20, 2022, 9:54 a.m.	thread_handle: 0x00000380 suspend_count: 1 process_identifier: 2796	1	0
CreateProcessInternalW Jan. 20, 2022, 9:54 a.m.	thread_identifier: 2292 thread_handle: 0x00000500 process_identifier: 2296 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\qs5ycixe1cg.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004f4	1	1
CreateProcessInternalW Jan. 20, 2022, 9:54 a.m.	thread_identifier: 2424 thread_handle: 0x00000504 process_identifier: 2416 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\9678012459.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003a4	1	1
NtGetContextThread Jan. 20, 2022, 9:54 a.m.	thread_handle: 0x00000504	1	0
NtAllocateVirtualMemory Jan. 20, 2022, 9:54 a.m.	process_identifier: 2416 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003a4	1	0
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2416 process_handle: 0x000003a4	1	1
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: base_address: 0x00401000 process_identifier: 2416 process_handle: 0x000003a4	1	1
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: base_address: 0x00415000 process_identifier: 2416 process_handle: 0x000003a4	1	1
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: TÍ<¨K¢`Ý;U base_address: 0x0041a000 process_identifier: 2416 process_handle: 0x000003a4	1	1
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: base_address: 0x004a0000 process_identifier: 2416 process_handle: 0x000003a4	1	1
WriteProcessMemory Jan. 20, 2022, 9:54 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2416 process_handle: 0x000003a4	1	1
NtSetContextThread Jan. 20, 2022, 9:54 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000504 process_identifier: 2416	1	0
NtResumeThread Jan. 20, 2022, 9:54 a.m.	thread_handle: 0x00000504 suspend_count: 1 process_identifier: 2416	1	0
CreateProcessInternalW Jan. 20, 2022, 9:54 a.m.	thread_identifier: 2496 thread_handle: 0x000002cc process_identifier: 2452 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "C:\Users\test22\AppData\Local\Temp\Bvekhpeqvyrnrcffile.pdf" filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002d8	1	1
NtResumeThread Jan. 20, 2022, 9:54 a.m.	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2416	1	0
CreateProcessInternalW Jan. 20, 2022, 9:54 a.m.	thread_identifier: 2588 thread_handle: 0x0000000000000098 process_identifier: 2592 current_directory: filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef4b0f1e8,0x7fef4b0f1f8,0x7fef4b0f208 filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000000000009c	1	1
CreateProcessInternalW Jan. 20, 2022, 9:54 a.m.	thread_identifier: 2776 thread_handle: 0x0000000000000144 process_identifier: 2792 current_directory: filepath: track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2496 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6 filepath_r: stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000148	1	1
NtResumeThread Jan. 20, 2022, 9:54 a.m.	thread_handle: 0x00000000000001c0 suspend_count: 1 process_identifier: 2452	1	0
CreateProcessInternalW Jan. 20, 2022, 9:55 a.m.	thread_identifier: 3068 thread_handle: 0x0000000000000614 process_identifier: 944 current_directory: filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1264,14278984462910021065,14971354701281110303,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=E177664F63EB3069B35A11E6E6F0425B --mojo-platform-channel-handle=1280 --ignored=" --type=renderer " /prefetch:2 filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 17302540 (CREATE_BREAKAWAY_FROM_JOB\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|DETACHED_PROCESS\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000000000005e4	1	1
NtResumeThread Jan. 20, 2022, 9:54 a.m.	thread_handle: 0x00000000000000e4 suspend_count: 1 process_identifier: 2592	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0
NtGetContextThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158	1	0
NtResumeThread Jan. 20, 2022, 9:55 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2452	1	0

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

9678012459.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All