Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 22, 2023, 4:15 p.m.	May 22, 2023, 4:21 p.m.

Size	4.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6355c5f8f98ffd7042a07ed616a2bb34`
SHA256	`a4812a7dd2dd31471e590d7a45ddc945dfbd646512a048a39383427e8ea885cc`
CRC32	`620137DE`
ssdeep	`98304:V5OVT7lWSbmaQ2MRiRJsXmFb55E9SRoy6biRmUgCOjzO8Hoh8AqZ0:VQTzmaQ2MaVFbZyHbWWvO8HoL`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

345534534.exe "C:\Users\test22\AppData\Local\Temp\345534534.exe"
2548
- 11.exe "C:\Windows\Temp\11.exe"
  2748
- 22.exe "C:\Windows\Temp\22.exe"
  2792
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --remote-debugging-port=37429 --headless --user-data-dir="C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM" --profile-directory="Default"
    2912
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x90,0x94,0x98,0x8c,0x9c,0x7fef42ef1e8,0x7fef42ef1f8,0x7fef42ef208
      3064
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2908 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
      2964
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod= --annotation=ver= --initial-client-data=0x154,0x158,0x15c,0x150,0x160,0x7fef3eb7218,0x7fef3eb7228,0x7fef3eb7238
      1152

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.99.133.246	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49246	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.101:49171	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 108 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 22, 2023, 4:15 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (50 out of 71 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0
IsDebuggerPresent May 22, 2023, 4:15 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey May 22, 2023, 4:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b2e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 4:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b2e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 4:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b2d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 4:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b3800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 4:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b3800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 22, 2023, 4:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002b3880 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 22, 2023, 4:15 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 22, 2023, 4:15 p.m.	stacktrace: 0x2b406cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 88 08 8d 56 ff f7 d2 8b ca 23 c8 89 4d e4 21 55 exception.symbol: IsBadWritePtr+0x34 GlobalHandle-0x5c kernel32+0x3d220 exception.instruction: mov byte ptr [eax], cl exception.module: kernel32.dll exception.exception_code: 0xc0000005 exception.offset: 250400 exception.address: 0x755ed220 registers.esp: 75300048 registers.edi: 33751754 registers.eax: 1968994832 registers.ebp: 75300092 registers.edx: 354807793 registers.ebx: 33751754 registers.esi: 4096 registers.ecx: 1968994955	1	0	0
__exception__ May 22, 2023, 4:15 p.m.	stacktrace: 0x434d40 0x3a2e0a 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 60 4d 43 00 00 00 00 00 20 4d 43 00 00 00 00 00 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x434d40 registers.r14: 147843904 registers.r15: 147844344 registers.rcx: 1412 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 181573984 registers.rsp: 147843080 registers.r11: 147847600 registers.r8: 1994752396 registers.r9: 0 registers.rdx: 1368 registers.r12: 32883680 registers.rbp: 147843216 registers.rdi: 32756784 registers.rax: 3812864 registers.r13: 147843776	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Starts servers listening (14 events)

Time & API	Arguments	Status	Return
bind May 22, 2023, 4:15 p.m.	ip_address: 0.0.0.0 socket: 316 port: 0	1	0
bind May 22, 2023, 4:15 p.m.	ip_address: 0.0.0.0 socket: 1248 port: 0	1	0
bind May 22, 2023, 4:15 p.m.	ip_address: 0.0.0.0 socket: 704 port: 0	1	0
bind May 22, 2023, 4:15 p.m.	ip_address: 127.0.0.1 socket: 1120 port: 37429	1	0
listen May 22, 2023, 4:15 p.m.	socket: 1120 backlog: 10	1	0
accept May 22, 2023, 4:15 p.m.	ip_address: socket: 1120 port: 0		-1
accept May 22, 2023, 4:15 p.m.	ip_address: 127.0.0.1 socket: 1120 port: 49173	1	1300
accept May 22, 2023, 4:15 p.m.	ip_address: socket: 1120 port: 0		-1
accept May 22, 2023, 4:15 p.m.	ip_address: 127.0.0.1 socket: 1120 port: 49174	1	1328
accept May 22, 2023, 4:15 p.m.	ip_address: socket: 1120 port: 0		-1
accept May 22, 2023, 4:15 p.m.	ip_address: 127.0.0.1 socket: 1120 port: 49175	1	1356
accept May 22, 2023, 4:15 p.m.	ip_address: socket: 1120 port: 0		-1
accept May 22, 2023, 4:15 p.m.	ip_address: 127.0.0.1 socket: 1120 port: 49176	1	1396
accept May 22, 2023, 4:15 p.m.	ip_address: socket: 1120 port: 0		-1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://185.99.133.246/c2sock

Performs some HTTP requests (1 event)

request

POST http://185.99.133.246/c2sock

Sends data using the HTTP POST Method (1 event)

request

POST http://185.99.133.246/c2sock

Allocates read-write-execute memory (usually to unpack itself) (50 out of 206810 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 2580480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02030000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 22, 2023, 4:15 p.m.	process_identifier: 2748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 2912 crashed
__exception__ May 22, 2023, 4:15 p.m.	stacktrace: 0x434d40 0x3a2e0a 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 60 4d 43 00 00 00 00 00 20 4d 43 00 00 00 00 00 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x434d40 registers.r14: 147843904 registers.r15: 147844344 registers.rcx: 1412 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 181573984 registers.rsp: 147843080 registers.r11: 147847600 registers.r8: 1994752396 registers.r9: 0 registers.rdx: 1368 registers.r12: 32883680 registers.rbp: 147843216 registers.rdi: 32756784 registers.rax: 3812864 registers.r13: 147843776	1	0	0

Steals private information from local Internet browsers (50 out of 140 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF3a15fe.TMP
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Visited Links
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Web Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Current Tabs
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Local Storage\leveldb\000004.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\History
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Local Storage\leveldb\LOG
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\QuotaManager
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Safe Browsing Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Current Session
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\blob_storage
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.ldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Safe Browsing Cookies-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Origin Bound Certs-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Local Storage\leveldb\LOCK
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\QuotaManager-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Local Storage\leveldb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Top Sites-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Default\Shortcuts
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Creates executable files on the filesystem (2 events)

file	C:\Windows\Temp\11.exe
file	C:\Windows\Temp\22.exe

Drops a binary and executes it (2 events)

file	C:\Windows\Temp\11.exe
file	C:\Windows\Temp\22.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (45 events)

Time & API	Arguments	Status	Return
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: smss.exe process_identifier: 224	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: csrss.exe process_identifier: 304	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: wininit.exe process_identifier: 352	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: csrss.exe process_identifier: 360	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: winlogon.exe process_identifier: 400	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: services.exe process_identifier: 444	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: lsass.exe process_identifier: 460	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: lsm.exe process_identifier: 468	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 572	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 652	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 724	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 784	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 832	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: audiodg.exe process_identifier: 900	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 992	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 292	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: spoolsv.exe process_identifier: 324	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 1048	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: srvany.exe process_identifier: 1284	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: KMService.exe process_identifier: 1436	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: conhost.exe process_identifier: 1448	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: taskhost.exe process_identifier: 1600	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: sppsvc.exe process_identifier: 1820	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: svchost.exe process_identifier: 1896	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: dwm.exe process_identifier: 1260	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: explorer.exe process_identifier: 1452	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: pw.exe process_identifier: 988	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: SearchIndexer.exe process_identifier: 1160	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: SearchProtocolHost.exe process_identifier: 936	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: SearchFilterHost.exe process_identifier: 2000	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: mobsync.exe process_identifier: 2276	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: pw.exe process_identifier: 2316	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: wsqmcons.exe process_identifier: 2336	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: taskhost.exe process_identifier: 2352	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: sdclt.exe process_identifier: 2368	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: 11.exe process_identifier: 2748	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: 22.exe process_identifier: 2792	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: chrome.exe process_identifier: 2912	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: chrome.exe process_identifier: 3064	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: schtasks.exe process_identifier: 3024	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: conhost.exe process_identifier: 3016	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000068 process_name: process_identifier: 94827632		0
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000154 process_name: chrome.exe process_identifier: 2964	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000154 process_name: chrome.exe process_identifier: 1152	1	1
Process32NextW May 22, 2023, 4:15 p.m.	snapshot_handle: 0x00000154 process_name: svchost.exe process_identifier: 1336	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 22, 2023, 4:15 p.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000e200', u'virtual_address': u'0x0005d000', u'entropy': 6.802287495720708, u'name': u'.rsrc', u'virtual_size': u'0x0000e034'}

entropy

6.80228749572

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 22, 2023, 4:15 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Expresses interest in specific running processes (1 event)

process

22.exe

Potentially malicious URLs were found in the process memory dump (50 out of 1099 events)

url	https://clients4.google.com/invalidation/android/request/
url	http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
url	http://services.ukrposhta.com/postindex_new/
url	http://dts.search-results.com/sr?lng=
url	http://creativecommons.org/ns
url	http://www.postur.fo/
url	https://qc.search.yahoo.com/search?ei=
url	https://cacert.omniroot.com/baltimoreroot.crt09
url	https://codereview.chromium.org/25305002).
url	https://search.yahoo.com/search?ei=
url	http://t1.symcb.com/ThawtePCA.crl0/
url	http://crbug.com/31395.
url	https://support.google.com/chrome/answer/165139
url	http://crbug.com/320723
url	https://datasaver.googleapis.com/v1/clientConfigs
url	http://crl.starfieldtech.com/sfroot-g2.crl0L
url	https://ct.startssl.com/
url	https://suggest.yandex.com.tr/suggest-ff.cgi?part=
url	https://de.search.yahoo.com/favicon.ico
url	https://github.com/GoogleChrome/Lighthouse/issues
url	http://www.searchnu.com/favicon.ico
url	https://support.google.com/installer/?product=
url	http://msdn.microsoft.com/en-us/library/ms792901.aspx
url	https://www.najdi.si/search.jsp?q=
url	http://x.ss2.us/x.cer0
url	http://crl.geotrust.com/crls/gtglobal.crl04
url	http://crbug.com/312900.
url	https://www.gstatic.com/chrome/ntp/doodle_test/ddljson_desktop3.json
url	https://c.android.clients.google.com/
url	https://www.google.com/tools/feedback/chrome/__submit
url	https://chrome.google.com/webstore/category/collection/dark_themes
url	http://check.googlezip.net/generate_204
url	http://ocsp.starfieldtech.com/08
url	http://www.guernseypost.com/postcode_finder/
url	http://crl.certum.pl/ca.crl0h
url	http://ator
url	https://suggest.yandex.by/suggest-ff.cgi?part=
url	http://feed.snap.do/?q=
url	https://sp.uk.ask.com/sh/i/a16/favicon/favicon.ico
url	http://www.language
url	https://support.google.com/chrome/
url	http://developer.chrome.com/apps/declare_permissions.html
url	http://www.google.com/chrome/intl/ko/eula_text.html
url	https://www.globalsign.com/repository/03
url	http://www.startssl.com/sfsca.crl0
url	http://UA-Compatible
url	https://se.search.yahoo.com/search?ei=
url	http://EVSecure-ocsp.geotrust.com0
url	https://developers.google.com/web/fundamentals/accessibility/accessible-styles
url	https://mammoth.ct.comodo.com/

Yara rule detected in process memory (50 out of 1110 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	Perform crypto currency mining	rule	BitCoin
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	browser info stealer	rule	infoStealer_browser_Zero
description	Steal credential	rule	local_credential_Steal
description	Virtual currency	rule	Virtual_currency_Zero
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Take ScreenShot	rule	ScreenShot
description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	Perform crypto currency mining	rule	BitCoin
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	browser info stealer	rule	infoStealer_browser_Zero
description	Steal credential	rule	local_credential_Steal
description	Virtual currency	rule	Virtual_currency_Zero

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000218 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW May 22, 2023, 4:15 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x80000002 key_handle: 0x000001b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Terminates another process (3 events)

Time & API	Arguments	Status
NtTerminateProcess May 22, 2023, 4:15 p.m.	status_code: 0xffffffff process_identifier: 2792 process_handle: 0x00000574
NtTerminateProcess May 22, 2023, 4:15 p.m.	status_code: 0xc0000005 process_identifier: 2912 process_handle: 0x0000000000000160
NtTerminateProcess May 22, 2023, 4:15 p.m.	status_code: 0xc0000005 process_identifier: 2912 process_handle: 0x0000000000000160	1

Communicates with host for which no DNS query was performed (1 event)

host

185.99.133.246

Checks for the presence of known devices from debuggers and forensic tools (4 events)

file	\??\SICE
file	\??\SIWVID
file	\??\SIWDEBUG
file	\??\NTICE

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 22, 2023, 4:15 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

22.exe tried to sleep 2728305 seconds, actually delayed analysis time by 2728305 seconds

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Bitcoin\wallets
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW May 22, 2023, 4:15 p.m.	key_handle: 0x000001b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

One or more non-whitelisted processes were created (4 events)

parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2908 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User DataZLVNM" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x90,0x94,0x98,0x8c,0x9c,0x7fef42ef1e8,0x7fef42ef1f8,0x7fef42ef208
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod= --annotation=ver= --initial-client-data=0x154,0x158,0x15c,0x150,0x160,0x7fef3eb7218,0x7fef3eb7228,0x7fef3eb7238
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --use-gl=osmesa --disable-gpu-compositing --service-pipe-token=84000DA19A63F211DE990A7BC479D2DD --lang=en-US --headless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=84000DA19A63F211DE990A7BC479D2DD --renderer-client-id=2 --mojo-platform-channel-handle=1132 /prefetch:1

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (1 event)

url	http://127.0.0.1

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

Resumed a suspended thread in a remote process potentially indicative of process injection (31 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1152 resumed a thread in remote process 2912
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0
NtResumeThread May 22, 2023, 4:15 p.m.	thread_handle: 0x000000000000012c suspend_count: 2 process_identifier: 2912	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 22, 2023, 4:15 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealerc.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.67094403
FireEye	Generic.mg.6355c5f8f98ffd70
McAfee	Artemis!6355C5F8F98F
Cylance	unsafe
K7AntiVirus	Trojan ( 005a59cd1 )
Alibaba	TrojanPSW:Win32/Stealerc.dd05d9f4
K7GW	Trojan ( 005a59cd1 )
Arcabit	Trojan.Generic.D3FFC783
Cyren	W32/ABRisk.RGWE-5814
Symantec	Trojan.Gen.MBT
ESET-NOD32	multiple detections
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	Trojan-PSW.Win32.Stealerc.rv
BitDefender	Trojan.GenericKD.67094403
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-QQPass.QQRob.Gflw
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Redcap.nfikt
DrWeb	Trojan.PWS.Stealer.36707
VIPRE	Trojan.GenericKD.67094403
TrendMicro	TrojanSpy.Win32.LUMMASTEALER.YXDERZ
McAfee-GW-Edition	BehavesLike.Win32.Generic.rc
Emsisoft	Trojan.GenericKD.67094403 (B)
Ikarus	Trojan.SuspectCRC
Avira	TR/Redcap.nfikt
Antiy-AVL	Trojan/Win32.HTA
Gridinsoft	Spy.Win32.Gen.bot
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	Trojan-PSW.Win32.Stealerc.rv
GData	Trojan.GenericKD.67094403
Google	Detected
BitDefenderTheta	Gen:NN.ZexaE.36196.9F3@aOYT7DeO
ALYac	Trojan.GenericKD.67094403
MAX	malware (ai score=80)
Malwarebytes	Spyware.Lumma
TrendMicro-HouseCall	TrojanSpy.Win32.LUMMASTEALER.YXDERZ
Rising	Trojan.HTA!8.11E8A (TFE:5:N4c784Php0B)
SentinelOne	Static AI - Malicious SFX
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (D)

345534534.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All