Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 28, 2023, 4:31 p.m.	June 28, 2023, 4:44 p.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`e55683d061bb823c5ad9828c506f8c54`
SHA256	`291cd51d8323f339f3c97ea088d30fa0f4e37778ad1c2c36943f46db28d0c2f3`
CRC32	`157102C8`
ssdeep	`24576:O/3McAn36SCCf16qY9SMlHnmDAO69NO1F6eQ+1BLHgZpJkq:A+3TbsZlHiAO6XO1F6eQ+vLHkJkq`
PDB Path	avatar4crabsburger.pdb
Yara	UPX_Zero - UPX packed file Is_DotNET_EXE - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE32 - (no description) PE_Header_Zero - PE File Signature

Bar0627SetUp.exe "C:\Users\test22\AppData\Local\Temp\Bar0627SetUp.exe"
2004
- MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
  2464
  - GE4Q3E63J95M6H1.exe "C:\Users\test22\AppData\Local\Temp\GE4Q3E63J95M6H1.exe"
    2648
    - MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
      2924
  - 0H2JLQD7JEBJQ1F.exe "C:\Users\test22\AppData\Local\Temp\0H2JLQD7JEBJQ1F.exe"
    2708
  - 16MHEDLHCDLB50P.exe https://iplogger.com/12waJ4
    2788

Name	Response	Post-Analysis Lookup
iplogger.com	A 148.251.234.93	148.251.234.93
dzen.ru	A 62.217.160.2	62.217.160.2
tokoi45.beget.tech	A 5.101.152.100	5.101.152.100
yandex.ru	A 5.255.255.77 A 77.88.55.88 A 77.88.55.60 A 5.255.255.70	5.255.255.70
sso.passport.yandex.ru	A 213.180.204.24 CNAME passport.yandex.ru	213.180.204.24
allansworthng.com	A 108.178.17.142	108.178.17.142

IP Address	Status	Action
108.178.17.142	Active	Moloch
148.251.234.93	Active	Moloch
164.124.101.2	Active	Moloch
168.119.239.218	Active	Moloch
213.180.204.24	Active	Moloch
5.101.152.100	Active	Moloch
5.255.255.70	Active	Moloch
62.217.160.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 108.178.17.142:80 -> 192.168.56.103:49170	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 108.178.17.142:80 -> 192.168.56.103:49169	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.103:49183 -> 168.119.239.218:36938	2043233	ET MALWARE RedLine Stealer TCP CnC net.tcp Init	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 62.217.160.2:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49185 -> 148.251.234.93:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49180 -> 213.180.204.24:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49184 -> 148.251.234.93:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 148.251.234.93:443 -> 192.168.56.103:49186	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 5.255.255.70:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49179 62.217.160.2:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.dzen.ru	6a:31:14:29:60:07:c9:c6:17:7b:d1:27:ad:53:57:ec:d8:c1:d8:d2
TLSv1 192.168.56.103:49180 213.180.204.24:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=Yandex LLC, CN=sso.passport.yandex.ru	f0:52:26:54:41:65:2b:6a:37:7b:c1:5b:de:9c:e9:d4:41:c6:81:2d
TLSv1 192.168.56.103:49176 5.255.255.70:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=Yandex LLC, CN=*.xn--d1acpjx3f.xn--p1ai	7a:e6:ff:bb:19:79:e4:52:b5:47:97:69:f8:78:1c:38:bd:e6:2f:c2

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 4:32 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (10 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 28, 2023, 4:31 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:31 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:31 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:31 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:31 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:31 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:24 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:24 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:32 p.m.			0	0
IsDebuggerPresent June 28, 2023, 4:32 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (12 events)

Time & API	Arguments	Status	Return
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046fad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046fad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046fb58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046ff18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046ff98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046ff98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004700d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004700d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00470018 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046fed8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046fed8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 28, 2023, 4:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046fed8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

avatar4crabsburger.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 28, 2023, 4:31 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	XML
resource name	None

One or more processes crashed (17 events)

Time & API	Arguments	Status
__exception__ June 28, 2023, 4:31 p.m.	stacktrace: 0h2jlqd7jebjq1f+0x3ba277 @ 0x115a277 0h2jlqd7jebjq1f+0x3f8bac @ 0x1198bac exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 65 31 94 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 3209484 registers.edi: 15581184 registers.eax: 3209484 registers.ebp: 3209564 registers.edx: 2130566132 registers.ebx: 1969225702 registers.esi: 2006021163 registers.ecx: 2498822144	1
__exception__ June 28, 2023, 4:31 p.m.	stacktrace: exception.instruction_r: ed e9 b5 79 ff ff f1 af d7 39 58 18 e2 49 ff ff exception.symbol: 0h2jlqd7jebjq1f+0x4281f1 exception.instruction: in eax, dx exception.module: 0H2JLQD7JEBJQ1F.exe exception.exception_code: 0xc0000096 exception.offset: 4358641 exception.address: 0x11c81f1 registers.esp: 3209604 registers.edi: 16827564 registers.eax: 1750617430 registers.ebp: 15581184 registers.edx: 5331030 registers.ebx: 14286848 registers.esi: 13 registers.ecx: 20	1
__exception__ June 28, 2023, 4:31 p.m.	stacktrace: exception.instruction_r: ed e9 ac c2 fe ff c3 e9 30 05 fe ff 7c ca e1 db exception.symbol: 0h2jlqd7jebjq1f+0x421087 exception.instruction: in eax, dx exception.module: 0H2JLQD7JEBJQ1F.exe exception.exception_code: 0xc0000096 exception.offset: 4329607 exception.address: 0x11c1087 registers.esp: 3209604 registers.edi: 16827564 registers.eax: 1447909480 registers.ebp: 15581184 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66539a 0x66531d 0x661199 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66543b registers.esp: 4124736 registers.edi: 40846088 registers.eax: 0 registers.ebp: 4124764 registers.edx: 4598120 registers.ebx: 40801008 registers.esi: 40846228 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x667864 0x6677c3 0x666be7 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 3d fe ff ff eb 11 e8 b7 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x667aff registers.esp: 4124420 registers.edi: 43413246 registers.eax: 43210492 registers.ebp: 4124484 registers.edx: 0 registers.ebx: 43210492 registers.esi: 4204814 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x667864 0x6677e0 0x666be7 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 3d fe ff ff eb 11 e8 b7 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x667aff registers.esp: 4124420 registers.edi: 40934402 registers.eax: 40894452 registers.ebp: 4124484 registers.edx: 0 registers.ebx: 40894452 registers.esi: 4204814 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x667864 0x6677e0 0x666be7 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 3d fe ff ff eb 11 e8 b7 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x667aff registers.esp: 4124420 registers.edi: 42238670 registers.eax: 42035984 registers.ebp: 4124484 registers.edx: 0 registers.ebx: 42035984 registers.esi: 4204814 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a149 0x666d77 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f b8 fe ff ff eb 1f c7 45 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66a3a9 registers.esp: 4124444 registers.edi: 41645064 registers.eax: 41405168 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 41405168 registers.esi: 4203284 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a149 0x666d77 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f b8 fe ff ff eb 1f c7 45 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66a3a9 registers.esp: 4124444 registers.edi: 42991064 registers.eax: 42751168 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 42751168 registers.esi: 4203284 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a149 0x666d77 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f b8 fe ff ff eb 1f c7 45 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66a3a9 registers.esp: 4124444 registers.edi: 44337064 registers.eax: 44097168 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 44097168 registers.esi: 4203284 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a519 0x666e12 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 78 fe ff ff eb 16 e8 0b exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66a7ab registers.esp: 4124440 registers.edi: 41186668 registers.eax: 0 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 40648872 registers.esi: 4202576 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a519 0x666e12 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 78 fe ff ff eb 16 e8 0b exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66a7ab registers.esp: 4124440 registers.edi: 42579016 registers.eax: 0 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 42284992 registers.esi: 4202576 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a519 0x666e12 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 78 fe ff ff eb 16 e8 0b exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66a7ab registers.esp: 4124440 registers.edi: 43971352 registers.eax: 0 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 43677328 registers.esi: 4202576 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a849 0x666e89 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 12 ff ff ff eb 11 e8 16 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66aa1c registers.esp: 4124444 registers.edi: 43974960 registers.eax: 0 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 43974832 registers.esi: 40648820 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a849 0x666e89 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 12 ff ff ff eb 11 e8 16 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66aa1c registers.esp: 4124444 registers.edi: 41192472 registers.eax: 0 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 41192360 registers.esi: 42287424 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66a849 0x666e89 0x666624 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 12 ff ff ff eb 11 e8 16 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66aa1c registers.esp: 4124444 registers.edi: 42587252 registers.eax: 0 registers.ebp: 4124500 registers.edx: 0 registers.ebx: 42587140 registers.esi: 43682192 registers.ecx: 0	1
__exception__ June 28, 2023, 4:32 p.m.	stacktrace: 0x66add9 0x66663c 0x6656e8 0x6611be 0x660e26 0x660076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f a3 fe ff ff eb 0a e8 fd exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x66b2b9 registers.esp: 4124612 registers.edi: 44468874 registers.eax: 0 registers.ebp: 4124664 registers.edx: 0 registers.ebx: 44249560 registers.esi: 4206350 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (10 events)

suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://tokoi45.beget.tech/server.txt
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://tokoi45.beget.tech/server1.txt
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://tokoi45.beget.tech/server2.txt
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://allansworthng.com/2/data64_1.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://allansworthng.com/2/data64_2.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://allansworthng.com/2/data64_3.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://allansworthng.com/2/data64_4.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://allansworthng.com/2/data64_5.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://allansworthng.com/2/data64_6.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://allansworthng.com/webArg2.txt

Performs some HTTP requests (13 events)

request	GET http://tokoi45.beget.tech/server.txt
request	GET http://tokoi45.beget.tech/server1.txt
request	GET http://tokoi45.beget.tech/server2.txt
request	GET http://allansworthng.com/2/data64_1.exe
request	GET http://allansworthng.com/2/data64_2.exe
request	GET http://allansworthng.com/2/data64_3.exe
request	GET http://allansworthng.com/2/data64_4.exe
request	GET http://allansworthng.com/2/data64_5.exe
request	GET http://allansworthng.com/2/data64_6.exe
request	GET http://allansworthng.com/webArg2.txt
request	GET https://yandex.ru/
request	GET https://dzen.ru/?yredirect=true
request	GET https://sso.passport.yandex.ru/push?uuid=b62b00ef-65a3-48b0-8130-ecb2c8c9a624&retpath=https%3A%2F%2Fdzen.ru%2F%3Fyredirect%3Dtrue

Allocates read-write-execute memory (usually to unpack itself) (50 out of 297 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00556000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c0f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Roaming\NVIDIA\dllhost.exe
file	C:\Users\test22\AppData\Local\Temp\GE4Q3E63J95M6H1.exe
file	C:\Users\test22\AppData\Local\Temp\0H2JLQD7JEBJQ1F.exe
file	C:\Users\test22\AppData\Local\Temp\16MHEDLHCDLB50P.exe

Drops a binary and executes it (3 events)

file	C:\Users\test22\AppData\Local\Temp\GE4Q3E63J95M6H1.exe
file	C:\Users\test22\AppData\Local\Temp\0H2JLQD7JEBJQ1F.exe
file	C:\Users\test22\AppData\Local\Temp\16MHEDLHCDLB50P.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\0H2JLQD7JEBJQ1F.exe
file	C:\Users\test22\AppData\Local\Temp\GE4Q3E63J95M6H1.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 28, 2023, 4:31 p.m.	thread_identifier: 2792 thread_handle: 0x0000011c process_identifier: 2788 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\16MHEDLHCDLB50P.exe track: 1 command_line: https://iplogger.com/12waJ4 filepath_r: C:\Users\test22\AppData\Local\Temp\16MHEDLHCDLB50P.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000118	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 28, 2023, 4:31 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000c4a00', u'virtual_address': u'0x00002000', u'entropy': 7.886700504578438, u'name': u'.text', u'virtual_size': u'0x000c49a4'}

entropy

7.88670050458

description

A section with a high entropy has been found

entropy

0.624206349206

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 28, 2023, 4:31 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 28, 2023, 4:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 28, 2023, 4:31 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 28, 2023, 4:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Expresses interest in specific running processes (1 event)

process

system

Yara rule detected in process memory (19 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 51 events)

Time & API	Arguments	Status
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: 7-Zip base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: AddressBook base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: Adobe AIR base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: Connection Manager base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: DirectDrawEx base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: EditPlus base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: Fontcore base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: Google Chrome base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: IE40 base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: IE4Data base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: IE5BAKEX base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: IEData base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: MobileOptionPack base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: Office15.PROPLUSR base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: SchedulingAgent base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: WIC base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW June 28, 2023, 4:32 p.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x00000210 key_handle: 0x0000030c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess June 28, 2023, 4:31 p.m.	status_code: 0xffffffff process_identifier: 2428 process_handle: 0x00000248		0	0
NtTerminateProcess June 28, 2023, 4:31 p.m.	status_code: 0xffffffff process_identifier: 2428 process_handle: 0x00000248	1	0	0

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: 8a7a16e1bb29ef6a29ec7e71bdc776d6bdfda170
buffer	Buffer with sha1: b2ad5f58676456829f8d8530a7e9cf0dd022f1ca
buffer	Buffer with sha1: 902542c855ddb7afdddbc42ce5e4cde04e9e3e5f

Communicates with host for which no DNS query was performed (1 event)

host

168.119.239.218

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2428 region_size: 598016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240		3221225496
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2464 region_size: 598016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	1	0
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2924 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0

Checks for the presence of known windows from debuggers and forensic tools (12 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA June 28, 2023, 4:31 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA June 28, 2023, 4:31 p.m.	class_name: 18467-41 window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Steam

reg_value

C:\Users\test22\AppData\Roaming\NVIDIA\dllhost.exe

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA June 28, 2023, 4:24 p.m.	key_handle: 0x0000000000000414 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2004 manipulating memory of non-child process 2428
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2428 region_size: 598016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240		3221225496	0

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $],~DMMMR5 MR5¯MR5M¦1 M¦1M¦1JMR5MM»MÀ0MÀ0MRichMPELidà#@¼àCP@ @[PÐüL8P @Pä.texto>@ `.rdata(PD@@.dataVpBZ@À.relocüLÐN@B base_address: 0x00400000 process_identifier: 2464 process_handle: 0x00000244	1	1
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2464 process_handle: 0x00000244	1	1
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELY1r¾à0bN @ `@K @ H.textT` b `.rsrc d@@.reloc@ú@B base_address: 0x00400000 process_identifier: 2924 process_handle: 0x0000022c	1	1
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: P0 base_address: 0x00424000 process_identifier: 2924 process_handle: 0x0000022c	1	1
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2924 process_handle: 0x0000022c	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $],~DMMMR5 MR5¯MR5M¦1 M¦1M¦1JMR5MM»MÀ0MÀ0MRichMPELidà#@¼àCP@ @[PÐüL8P @Pä.texto>@ `.rdata(PD@@.dataVpBZ@À.relocüLÐN@B base_address: 0x00400000 process_identifier: 2464 process_handle: 0x00000244	1	1	0
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELY1r¾à0bN @ `@K @ H.textT` b `.rsrc d@@.reloc@ú@B base_address: 0x00400000 process_identifier: 2924 process_handle: 0x0000022c	1	1	0

Collects information about installed applications (38 events)

Time & API	Arguments	Status
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW June 28, 2023, 4:32 p.m.	key_handle: 0x0000030c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2004 called NtSetContextThread to modify thread in remote process 2464
Process injection	Process 2648 called NtSetContextThread to modify thread in remote process 2924
NtSetContextThread June 28, 2023, 4:31 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4277216 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000248 process_identifier: 2464	1	0	0
NtSetContextThread June 28, 2023, 4:32 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4292686 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 2924	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2004 resumed a thread in remote process 2464
Process injection	Process 2648 resumed a thread in remote process 2924
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x00000248 suspend_count: 1 process_identifier: 2464	1	0	0
NtResumeThread June 28, 2023, 4:32 p.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 2924	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 28, 2023, 4:31 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 28, 2023, 4:31 p.m.	stacktrace: exception.instruction_r: ed e9 ac c2 fe ff c3 e9 30 05 fe ff 7c ca e1 db exception.symbol: 0h2jlqd7jebjq1f+0x421087 exception.instruction: in eax, dx exception.module: 0H2JLQD7JEBJQ1F.exe exception.exception_code: 0xc0000096 exception.offset: 4329607 exception.address: 0x11c1087 registers.esp: 3209604 registers.edi: 16827564 registers.eax: 1447909480 registers.ebp: 15581184 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AJCZ
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	VHO:Trojan-Spy.MSIL.Stealer.gen
Avast	PWSX-gen [Trj]
FireEye	Generic.mg.e55683d061bb823c
Sophos	ML/PE-A
Ikarus	Trojan.MSIL.Injector
ZoneAlarm	VHO:Trojan-Spy.MSIL.Stealer.gen
Google	Detected
Acronis	suspicious
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.GKZJ!tr
BitDefenderTheta	Gen:NN.ZemsilF.36270.prX@aG7p6Dhk
AVG	PWSX-gen [Trj]
DeepInstinct	MALICIOUS

Executed a process and injected code into it, probably while unpacking (50 out of 55 events)

Time & API	Arguments	Status	Return
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2004	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2004	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2004	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2004	1	0
NtGetContextThread June 28, 2023, 4:31 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread June 28, 2023, 4:31 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2004	1	0
CreateProcessInternalW June 28, 2023, 4:31 p.m.	thread_identifier: 2432 thread_handle: 0x0000023c process_identifier: 2428 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000240	1	1
NtGetContextThread June 28, 2023, 4:31 p.m.	thread_handle: 0x0000023c	1	0
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2428 region_size: 598016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240		3221225496
CreateProcessInternalW June 28, 2023, 4:31 p.m.	thread_identifier: 2468 thread_handle: 0x00000248 process_identifier: 2464 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000244	1	1
NtGetContextThread June 28, 2023, 4:31 p.m.	thread_handle: 0x00000248	1	0
NtAllocateVirtualMemory June 28, 2023, 4:31 p.m.	process_identifier: 2464 region_size: 598016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	1	0
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $],~DMMMR5 MR5¯MR5M¦1 M¦1M¦1JMR5MM»MÀ0MÀ0MRichMPELidà#@¼àCP@ @[PÐüL8P @Pä.texto>@ `.rdata(PD@@.dataVpBZ@À.relocüLÐN@B base_address: 0x00400000 process_identifier: 2464 process_handle: 0x00000244	1	1
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: base_address: 0x00401000 process_identifier: 2464 process_handle: 0x00000244	1	1
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: base_address: 0x00465000 process_identifier: 2464 process_handle: 0x00000244	1	1
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: base_address: 0x00487000 process_identifier: 2464 process_handle: 0x00000244	1	1
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: base_address: 0x0048d000 process_identifier: 2464 process_handle: 0x00000244	1	1
WriteProcessMemory June 28, 2023, 4:31 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2464 process_handle: 0x00000244	1	1
NtSetContextThread June 28, 2023, 4:31 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4277216 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000248 process_identifier: 2464	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x00000248 suspend_count: 1 process_identifier: 2464	1	0
CreateProcessInternalW June 28, 2023, 4:31 p.m.	thread_identifier: 2652 thread_handle: 0x0000007c process_identifier: 2648 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\GE4Q3E63J95M6H1.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\GE4Q3E63J95M6H1.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000080	1	1
CreateProcessInternalW June 28, 2023, 4:31 p.m.	thread_identifier: 2712 thread_handle: 0x00000100 process_identifier: 2708 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\0H2JLQD7JEBJQ1F.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\0H2JLQD7JEBJQ1F.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000114	1	1
CreateProcessInternalW June 28, 2023, 4:31 p.m.	thread_identifier: 2792 thread_handle: 0x0000011c process_identifier: 2788 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\16MHEDLHCDLB50P.exe track: 1 command_line: https://iplogger.com/12waJ4 filepath_r: C:\Users\test22\AppData\Local\Temp\16MHEDLHCDLB50P.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000118	1	1
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2648	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2648	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2648	1	0
CreateProcessInternalW June 28, 2023, 4:32 p.m.	thread_identifier: 2928 thread_handle: 0x00000228 process_identifier: 2924 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000022c	1	1
NtGetContextThread June 28, 2023, 4:32 p.m.	thread_handle: 0x00000228	1	0
NtAllocateVirtualMemory June 28, 2023, 4:32 p.m.	process_identifier: 2924 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELY1r¾à0bN @ `@K @ H.textT` b `.rsrc d@@.reloc@ú@B base_address: 0x00400000 process_identifier: 2924 process_handle: 0x0000022c	1	1
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: base_address: 0x00402000 process_identifier: 2924 process_handle: 0x0000022c	1	1
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: base_address: 0x0041a000 process_identifier: 2924 process_handle: 0x0000022c	1	1
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: P0 base_address: 0x00424000 process_identifier: 2924 process_handle: 0x0000022c	1	1
WriteProcessMemory June 28, 2023, 4:32 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2924 process_handle: 0x0000022c	1	1
NtSetContextThread June 28, 2023, 4:32 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4292686 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 2924	1	0
NtResumeThread June 28, 2023, 4:32 p.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 2924	1	0
NtGetContextThread June 28, 2023, 4:31 p.m.	thread_handle: 0xfffffffe	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2708	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 2708	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x000001ac suspend_count: 1 process_identifier: 2708	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x00000348 suspend_count: 1 process_identifier: 2708	1	0
NtResumeThread June 28, 2023, 4:31 p.m.	thread_handle: 0x0000059c suspend_count: 1 process_identifier: 2708	1	0
NtResumeThread June 28, 2023, 4:24 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2788	1	0
NtResumeThread June 28, 2023, 4:24 p.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 2788	1	0
NtResumeThread June 28, 2023, 4:24 p.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 2788	1	0
NtResumeThread June 28, 2023, 4:25 p.m.	thread_handle: 0x0000000000000558 suspend_count: 1 process_identifier: 2788	1	0
NtGetContextThread June 28, 2023, 4:25 p.m.	thread_handle: 0xfffffffffffffffe	1	0
NtGetContextThread June 28, 2023, 4:25 p.m.	thread_handle: 0xfffffffffffffffe	1	0
NtGetContextThread June 28, 2023, 4:25 p.m.	thread_handle: 0xfffffffffffffffe	1	0

Bar0627SetUp.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All