Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 24, 2023, 6:06 p.m.	March 24, 2023, 6:08 p.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`719082dcc3c017e5b675c8b9ec74b6a1`
SHA256	`6a57409b5f4d0ae13167353c059ddf4b9fe7920647a119a70438dae02a35586e`
CRC32	`C0374A0C`
ssdeep	`24576:kTbBv5rUlINj1z+EmdKiTazGSfcElXv8zcAsMVMgSZwU:WBREd3GGSfNpAjpS`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

98.exe "C:\Users\test22\AppData\Local\Temp\98.exe"
940
- 123.exe "C:\Windows\Temp\123.exe"
  2092
  - RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    2196
- 321.exe "C:\Windows\Temp\321.exe"
  2136
  - RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    2204

Name	Response	Post-Analysis Lookup
pastebin.com	A 104.20.67.143 A 172.67.34.170 A 104.20.68.143	104.20.67.143
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
164.124.101.2	Active	Moloch
51.210.161.21	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:06 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:07 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 24, 2023, 6:07 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 24, 2023, 6:06 p.m.			0	0
IsDebuggerPresent March 24, 2023, 6:06 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (17 events)

Time & API	Arguments	Status	Return
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329090 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329090 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329090 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329090 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329090 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329310 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329a50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329a50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 6:06 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00329750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 24, 2023, 6:06 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (50 out of 90 events)

Time & API	Arguments	Status
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: 123+0x7e82 @ 0x1387e82 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 3799504 registers.edi: 5177344 registers.eax: 2196 registers.ebp: 3799532 registers.edx: 2130566132 registers.ebx: 1024 registers.esi: 20836992 registers.ecx: 2096	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: 321+0x7e82 @ 0x857e82 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 3078032 registers.edi: 6877184 registers.eax: 2204 registers.ebp: 3078060 registers.edx: 2130566132 registers.ebx: 24576 registers.esi: 9954944 registers.ecx: 2140	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4165640 registers.edi: 2491312 registers.eax: 4165640 registers.ebp: 4165720 registers.edx: 2 registers.ebx: 1077276 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4165640 registers.edi: 2491312 registers.eax: 4165640 registers.ebp: 4165720 registers.edx: 2 registers.ebx: 1077276 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4165640 registers.edi: 2491312 registers.eax: 4165640 registers.ebp: 4165720 registers.edx: 2 registers.ebx: 1077276 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 wscanf_s+0x8323 regsvcs+0x42f53 @ 0x442f53 __swprintf_l-0x35831 regsvcs+0x2bcf @ 0x402bcf exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4165752 registers.edi: 2 registers.eax: 4165752 registers.ebp: 4165832 registers.edx: 2 registers.ebx: 2493848 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2930608 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 wscanf_s+0x8323 regsvcs+0x42f53 @ 0x442f53 __swprintf_l-0x35831 regsvcs+0x2bcf @ 0x402bcf exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4165780 registers.edi: 1 registers.eax: 4165780 registers.ebp: 4165860 registers.edx: 2 registers.ebx: 2493848 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166088 registers.edi: 2934896 registers.eax: 4166088 registers.ebp: 4166168 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1
__exception__ March 24, 2023, 6:06 p.m.	stacktrace: __swprintf_l-0x88c regsvcs+0x37b74 @ 0x437b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe24c4a02 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 4166172 registers.edi: 2934896 registers.eax: 4166172 registers.ebp: 4166252 registers.edx: 2 registers.ebx: 2490824 registers.esi: 2490824 registers.ecx: 2490824	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 82 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x013df000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2092 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00984000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2136 region_size: 1069056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7596c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778c0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75872000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75965000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75965000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75965000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02060000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00596000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00598000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fcf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW March 24, 2023, 6:06 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 0 root_path: C:\Users\test22\AppData\Local\Temp\Temporary Internet Files\Content.IE5 total_number_of_bytes: 0		0
GetDiskFreeSpaceExW March 24, 2023, 6:06 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 0 root_path: C:\Users\test22\AppData\Local\Temp\Temporary Internet Files\Content.IE5 total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW March 24, 2023, 6:06 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 0 root_path: C:\Users\test22\AppData\Local\Temp\Temporary Internet Files\Content.IE5 total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW March 24, 2023, 6:06 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 0 root_path: C:\Users\test22\AppData\Local\Temp\Temporary Internet Files\Content.IE5 total_number_of_bytes: 34252779520	1	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Looks up the external IP address (1 event)

domain

ip-api.com

Creates executable files on the filesystem (2 events)

file	C:\Windows\Temp\123.exe
file	C:\Windows\Temp\321.exe

Drops a binary and executes it (2 events)

file	C:\Windows\Temp\123.exe
file	C:\Windows\Temp\321.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 65536 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7efa0000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000e200', u'virtual_address': u'0x00064000', u'entropy': 6.802173495258792, u'name': u'.rsrc', u'virtual_size': u'0x0000e050'}

entropy

6.80217349526

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 24, 2023, 6:06 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (18 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 51 events)

Time & API	Arguments	Status
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000032c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: 7-Zip base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: AddressBook base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: Adobe AIR base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: Connection Manager base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: DirectDrawEx base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: EditPlus base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: Fontcore base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: Google Chrome base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: IE40 base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: IE4Data base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: IE5BAKEX base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: IEData base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: MobileOptionPack base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: Office15.PROPLUSR base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: SchedulingAgent base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: WIC base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW March 24, 2023, 6:06 p.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x0000032c key_handle: 0x00000328 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 69c6641080f428d76ee312c83b3d17f333b8e41a
buffer	Buffer with sha1: feaa642d3c78ff3bbe66d4d090d07fd2a8dae593

Communicates with host for which no DNS query was performed (1 event)

host

51.210.161.21

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000003c	1	0	0
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 region_size: 1069056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000003c	1	0	0

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 24, 2023, 6:06 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2196 process_handle: 0x0000003c	1	1	0
WriteProcessMemory March 24, 2023, 6:06 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2204 process_handle: 0x0000003c	1	1	0

Collects information about installed applications (38 events)

Time & API	Arguments	Status
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW March 24, 2023, 6:06 p.m.	key_handle: 0x00000328 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2092 called NtSetContextThread to modify thread in remote process 2196
Process injection	Process 2136 called NtSetContextThread to modify thread in remote process 2204
NtSetContextThread March 24, 2023, 6:06 p.m.	registers.eip: 2005598660 registers.esp: 3013856 registers.edi: 0 registers.eax: 4306430 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000038 process_identifier: 2196	1	0	0
NtSetContextThread March 24, 2023, 6:06 p.m.	registers.eip: 2005598660 registers.esp: 4192588 registers.edi: 0 registers.eax: 4762302 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000038 process_identifier: 2204	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2092 resumed a thread in remote process 2196
Process injection	Process 2136 resumed a thread in remote process 2204
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x00000038 suspend_count: 1 process_identifier: 2196	1	0	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x00000038 suspend_count: 1 process_identifier: 2204	1	0	0

Executed a process and injected code into it, probably while unpacking (32 events)

Time & API	Arguments	Status	Return
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x00000184 suspend_count: 1 process_identifier: 940	1	0
CreateProcessInternalW March 24, 2023, 6:06 p.m.	thread_identifier: 2096 thread_handle: 0x0000025c process_identifier: 2092 current_directory: C:\Windows\Temp filepath: C:\Windows\Temp\123.exe track: 1 command_line: "C:\Windows\Temp\123.exe" filepath_r: C:\Windows\Temp\123.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000248	1	1
CreateProcessInternalW March 24, 2023, 6:06 p.m.	thread_identifier: 2140 thread_handle: 0x000001fc process_identifier: 2136 current_directory: C:\Windows\Temp filepath: C:\Windows\Temp\321.exe track: 1 command_line: "C:\Windows\Temp\321.exe" filepath_r: C:\Windows\Temp\321.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002a4	1	1
CreateProcessInternalW March 24, 2023, 6:06 p.m.	thread_identifier: 2200 thread_handle: 0x00000038 process_identifier: 2196 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000003c	1	1
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x00000038	1	0
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2196 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000003c	1	0
WriteProcessMemory March 24, 2023, 6:06 p.m.	buffer: base_address: 0x00400000 process_identifier: 2196 process_handle: 0x0000003c	1	1
WriteProcessMemory March 24, 2023, 6:06 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2196 process_handle: 0x0000003c	1	1
NtSetContextThread March 24, 2023, 6:06 p.m.	registers.eip: 2005598660 registers.esp: 3013856 registers.edi: 0 registers.eax: 4306430 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000038 process_identifier: 2196	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x00000038 suspend_count: 1 process_identifier: 2196	1	0
CreateProcessInternalW March 24, 2023, 6:06 p.m.	thread_identifier: 2208 thread_handle: 0x00000038 process_identifier: 2204 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000003c	1	1
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x00000038	1	0
NtAllocateVirtualMemory March 24, 2023, 6:06 p.m.	process_identifier: 2204 region_size: 1069056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000003c	1	0
WriteProcessMemory March 24, 2023, 6:06 p.m.	buffer: base_address: 0x00400000 process_identifier: 2204 process_handle: 0x0000003c	1	1
WriteProcessMemory March 24, 2023, 6:06 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2204 process_handle: 0x0000003c	1	1
NtSetContextThread March 24, 2023, 6:06 p.m.	registers.eip: 2005598660 registers.esp: 4192588 registers.edi: 0 registers.eax: 4762302 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000038 process_identifier: 2204	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x00000038 suspend_count: 1 process_identifier: 2204	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2196	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2196	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2196	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x0000034c suspend_count: 1 process_identifier: 2196	1	0
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2196	1	0
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread March 24, 2023, 6:06 p.m.	registers.eip: 1943481220 registers.esp: 3009452 registers.edi: 56500113 registers.eax: 86573568 registers.ebp: 3009492 registers.edx: 81 registers.ebx: 0 registers.esi: 81 registers.ecx: 37806196 thread_handle: 0x000000e0 process_identifier: 2196	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2196	1	0
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread March 24, 2023, 6:06 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2196	1	0

98.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All