Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 8, 2023, 1:59 p.m.	July 8, 2023, 2:05 p.m.

Size	1.1MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`a3be2d1b0cdf0bb7aa40cf2cbe054a51`
SHA256	`61f153d1556005b0d3da25f9dee8b0f087b8e2c76e870031ecfa456ff63182d9`
CRC32	`74C8FB61`
ssdeep	`24576:K5D35xM/lGv10ht+qRYKcP+xzfS4nue5/PMFg5:+LkdGvp7g0g5`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

bnhost.exe "C:\Users\test22\AppData\Local\Temp\bnhost.exe"
2580

Name	Response	Post-Analysis Lookup
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.12.31

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.75.172	Active	Moloch
5.42.92.122	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 172.67.75.172:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 5.42.92.122:34244 -> 192.168.56.101:49163	2045000	ET ATTACK_RESPONSE RedLine Stealer - CheckConnect Response	A Network Trojan was detected
TCP 5.42.92.122:34244 -> 192.168.56.101:49163	2045001	ET ATTACK_RESPONSE Win32/LeftHook Stealer Browser Extension Config Inbound	A Network Trojan was detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49164 172.67.75.172:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	53:56:0b:3a:91:49:7f:18:59:87:21:98:d3:7f:98:0b:b4:ae:cb:cc

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameA July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 8, 2023, 1:59 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0
IsDebuggerPresent July 8, 2023, 1:59 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007df1d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007df1d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007df390 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x08177e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x08177e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x08177d70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007df690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007df650 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 8, 2023, 1:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007df650 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 8, 2023, 1:59 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section
section	.gbhnhtb

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (41 events)

Time & API	Arguments	Status
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b6c54 @ 0xff6c54 bnhost+0x1b171d @ 0xff171d bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3538032 registers.edi: 17707248 registers.eax: 0 registers.ebp: 3538060 registers.edx: 2 registers.ebx: 2783360357 registers.esi: 15187968 registers.ecx: 11417588	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b6c54 @ 0xff6c54 bnhost+0x1b171d @ 0xff171d bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3538032 registers.edi: 3538032 registers.eax: 0 registers.ebp: 3538060 registers.edx: 2 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3538068	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b6c54 @ 0xff6c54 bnhost+0x1b171d @ 0xff171d bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3538032 registers.edi: 3538032 registers.eax: 0 registers.ebp: 3538060 registers.edx: 2 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3538068	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b6c54 @ 0xff6c54 bnhost+0x1b171d @ 0xff171d bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3538032 registers.edi: 3538032 registers.eax: 0 registers.ebp: 3538060 registers.edx: 0 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3538068	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b6c54 @ 0xff6c54 bnhost+0x1b171d @ 0xff171d bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3538032 registers.edi: 3538032 registers.eax: 0 registers.ebp: 3538060 registers.edx: 0 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3538068	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b6c54 @ 0xff6c54 bnhost+0x1b171d @ 0xff171d bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3538032 registers.edi: 3538032 registers.eax: 0 registers.ebp: 3538060 registers.edx: 0 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3538068	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b2ec9 @ 0xff2ec9 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 16503280 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 10993664 registers.esi: 15187968 registers.ecx: 15187968	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b2ec9 @ 0xff2ec9 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b2ec9 @ 0xff2ec9 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b2ec9 @ 0xff2ec9 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b2ec9 @ 0xff2ec9 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b2ec9 @ 0xff2ec9 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b2ec9 @ 0xff2ec9 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b2ec9 @ 0xff2ec9 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b31ab @ 0xff31ab bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 16503280 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 10993664 registers.esi: 15187968 registers.ecx: 0	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b31ab @ 0xff31ab bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b31ab @ 0xff31ab bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b333e @ 0xff333e bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 16503280 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 10993664 registers.esi: 15187968 registers.ecx: 3537988	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b333e @ 0xff333e bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b333e @ 0xff333e bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b333e @ 0xff333e bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b34fe @ 0xff34fe bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 16503280 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 10993664 registers.esi: 15187968 registers.ecx: 0	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b34fe @ 0xff34fe bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b34fe @ 0xff34fe bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b3601 @ 0xff3601 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 16503280 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 10993664 registers.esi: 15187968 registers.ecx: 427	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b3601 @ 0xff3601 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b3601 @ 0xff3601 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf71f9 exception.instruction: div eax exception.module: bnhost.exe exception.exception_code: 0xc0000094 exception.offset: 1012217 exception.address: 0xf371f9 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 0 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b3601 @ 0xff3601 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954447 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b3601 @ 0xff3601 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b3601 @ 0xff3601 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: bnhost+0x1b3601 @ 0xff3601 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: bnhost+0xf7224 exception.instruction: ud2 exception.module: bnhost.exe exception.exception_code: 0xc000001d exception.offset: 1012260 exception.address: 0xf37224 registers.esp: 3537960 registers.edi: 3537960 registers.eax: 0 registers.ebp: 3537988 registers.edx: 2 registers.ebx: 15954490 registers.esi: 0 registers.ecx: 3537996	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42b7767 0x42b76a9 0x42b6b82 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534432 registers.edi: 80571696 registers.eax: 0 registers.ebp: 3534480 registers.edx: 71288984 registers.ebx: 80570480 registers.esi: 80570728 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42b7767 0x42b76a9 0x42b6b82 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534432 registers.edi: 81846884 registers.eax: 0 registers.ebp: 3534480 registers.edx: 71288984 registers.ebx: 81845668 registers.esi: 81845916 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42b7767 0x42b76a9 0x42b6b82 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534432 registers.edi: 83108416 registers.eax: 0 registers.ebp: 3534480 registers.edx: 71288984 registers.ebx: 83107200 registers.esi: 83107448 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42bae67 0x42badb9 0x42b6c6c 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534428 registers.edi: 80098276 registers.eax: 0 registers.ebp: 3534476 registers.edx: 71288984 registers.ebx: 80097060 registers.esi: 80097308 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42bae67 0x42badb9 0x42b6c6c 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534428 registers.edi: 81423368 registers.eax: 0 registers.ebp: 3534476 registers.edx: 71288984 registers.ebx: 81422152 registers.esi: 81422400 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42bae67 0x42badb9 0x42b6c6c 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534428 registers.edi: 82748460 registers.eax: 0 registers.ebp: 3534476 registers.edx: 71288984 registers.ebx: 82747244 registers.esi: 82747492 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42bb2b9 0x42bb209 0x42b6cdd 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534424 registers.edi: 80198436 registers.eax: 0 registers.ebp: 3534472 registers.edx: 71288984 registers.ebx: 80197220 registers.esi: 80197468 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42bb2b9 0x42bb209 0x42b6cdd 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534424 registers.edi: 81525780 registers.eax: 0 registers.ebp: 3534472 registers.edx: 71288984 registers.ebx: 81524564 registers.esi: 81524812 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x42bb2b9 0x42bb209 0x42b6cdd 0x42b6568 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 40 04 89 45 d0 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x42b7ae5 registers.esp: 3534424 registers.edi: 80574004 registers.eax: 0 registers.ebp: 3534472 registers.edx: 71288984 registers.ebx: 80572788 registers.esi: 80573036 registers.ecx: 71289556	1
__exception__ July 8, 2023, 1:59 p.m.	stacktrace: 0x7f42dba 0x7f42c37 0x42b56a7 0x42b4284 0x42b0165 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73bbf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741c4de3 bnhost+0x1b37a2 @ 0xff37a2 bnhost+0x1b1732 @ 0xff1732 bnhost+0x2a267a @ 0x10e267a exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7f42e88 registers.esp: 3534640 registers.edi: 80935096 registers.eax: 0 registers.ebp: 3534672 registers.edx: 8129304 registers.ebx: 80934928 registers.esi: 0 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://api.ip.sb/geoip

Performs some HTTP requests (1 event)

request

GET https://api.ip.sb/geoip

Allocates read-write-execute memory (usually to unpack itself) (50 out of 78 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 114688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e40000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04280000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x040c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x040f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04095000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0409b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04097000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x042b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x042b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x042b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f87000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef28000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0409c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0780f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 8, 2023, 1:59 p.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07801000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 8, 2023, 1:59 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00019c00', u'virtual_address': u'0x00002000', u'entropy': 7.996984181037299, u'name': u'', u'virtual_size': u'0x00034000'}

entropy

7.99698418104

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0002ba00', u'virtual_address': u'0x0003c000', u'entropy': 7.9982712041773905, u'name': u'', u'virtual_size': u'0x0027e000'}

entropy

7.99827120418

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000d5000', u'virtual_address': u'0x002ba000', u'entropy': 7.977684989415465, u'name': u'.gbhnhtb', u'virtual_size': u'0x000d6000'}

entropy

7.97768498942

description

A section with a high entropy has been found

entropy

0.998232434821

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 8, 2023, 1:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000006f8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: AddressBook base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: Connection Manager base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: DirectDrawEx base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: EditPlus base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: ENTERPRISE base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: Fontcore base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: Google Chrome base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: IE40 base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: IE4Data base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: IE5BAKEX base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: IEData base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: MobileOptionPack base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: SchedulingAgent base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: WIC base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW July 8, 2023, 1:59 p.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x000006f8 key_handle: 0x000006fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (1 event)

host

5.42.92.122

A process attempted to delay the analysis task. (1 event)

description

bnhost.exe tried to sleep 2076 seconds, actually delayed analysis time by 2076 seconds

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW July 8, 2023, 1:59 p.m.	key_handle: 0x000006fc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Generates some ICMP traffic

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetectMalware
FireEye	Generic.mg.a3be2d1b0cdf0bb7
McAfee	Artemis!A3BE2D1B0CDF
Malwarebytes	Malware.Heuristic.1003
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 0055f2201 )
K7GW	Trojan ( 0055f2201 )
Cybereason	malicious.430e66
Cyren	W32/Trojan.FFG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.Enigma.DS
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan-Spy.Win32.Stealer
Avast	PWSX-gen [Trj]
Tencent	Win32.Trojan.Agen.Ngil
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1354408
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Trapmine	malicious.high.ml.score
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1354408
Antiy-AVL	GrayWare/Win32.EnigmaProtect.a
Gridinsoft	Trojan.Heur!.030120A1
Microsoft	Trojan:MSIL/RedLineStealer.MK!MTB
ZoneAlarm	UDS:Trojan-Spy.Win32.Stealer
Google	Detected
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.36302.gzW@a8hQDOf
Cylance	unsafe
Rising	PUF.Pack-Enigma!1.BA33 (CLASSIC)
Ikarus	PUA.EnigmaProtector
AVG	PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

bnhost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All