Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 18, 2023, 6:10 p.m.	July 18, 2023, 6:10 p.m.

Size	135.9KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`742ac4a9557745ec565ada6511f4a31f`
SHA256	`3bcbd43c2a00cfc2b2565651f1a12625a93a3c76039078726c524e09e5231262`
CRC32	`0DA40DC6`
ssdeep	`3072:ni/QhtPjMiqUyqEBzJvl+AKetjEA0e06OHFEGuWk4Q:3DjMdFJvUbuWkL`
PDB Path	msdatl3.pdb
Yara	IsDLL - (no description) IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBaseObj@@IEAA@W4EBaseObjectType@@PEAUIUnknown@@PEAJ_N@Z
2228
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBaseObj@@IEAA@W4EBaseObjectType@@PEAUIUnknown@@PEAJ_N@Z
  236
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBaseObjBoko@@QEAA@W4EBaseObjectType@@PEAJ@Z
292
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBaseObjBoko@@QEAA@W4EBaseObjectType@@PEAJ@Z
  2556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBaseObj@@IEAA@W4EBaseObjectType@@PEAJ@Z
204
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBaseObj@@IEAA@W4EBaseObjectType@@PEAJ@Z
  2136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBaseObjZombie@@QEAA@W4EBaseObjectType@@PEAJ@Z
2432
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBaseObjZombie@@QEAA@W4EBaseObjectType@@PEAJ@Z
  2636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBitArray@@QEAA@XZ
1192
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CBitArray@@QEAA@XZ
  2572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CClassFactory@@AEAA@XZ
2120
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CClassFactory@@AEAA@XZ
  1328
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CClassFactory@@QEAA@AEBV0@@Z
2852
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CClassFactory@@QEAA@AEBV0@@Z
  2184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CClassFactory@@QEAA@PEAJ0@Z
2352
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CClassFactory@@QEAA@PEAJ0@Z
  2840
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CConnectData@@QEAA@XZ
2460
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CConnectData@@QEAA@XZ
  2116
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnum@@QEAA@PEAUIUnknown@@KPEAPEAXU_GUID@@_KKW4CENUMTYPE@@@Z
964
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnum@@QEAA@PEAUIUnknown@@KPEAPEAXU_GUID@@_KKW4CENUMTYPE@@@Z
  2844
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnumConnectionPoints@@QEAA@AEBV0@@Z
2688
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnumConnectionPoints@@QEAA@AEBV0@@Z
  568
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnumConnectionPoints@@QEAA@PEAUIUnknown@@KPEAPEAUIConnectionPoint@@@Z
832
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnumConnectionPoints@@QEAA@PEAUIUnknown@@KPEAPEAUIConnectionPoint@@@Z
  3028
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnumConnections@@QEAA@AEBV0@@Z
3060
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnumConnections@@QEAA@AEBV0@@Z
  3112
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnumConnections@@QEAA@PEAUIUnknown@@PEAUtagCONNECTDATA@@K@Z
2520
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CEnumConnections@@QEAA@PEAUIUnknown@@PEAUtagCONNECTDATA@@K@Z
  3184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CExtBuffer@@QEAA@XZ
3144
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CExtBuffer@@QEAA@XZ
  3388
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CGenericPooler@@QEAA@$$QEAV0@@Z
3332
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CGenericPooler@@QEAA@$$QEAV0@@Z
  3504
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CGenericPooler@@QEAA@AEBV0@@Z
3476
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CGenericPooler@@QEAA@AEBV0@@Z
  3700
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CGenericPooler@@QEAA@XZ
3632
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CGenericPooler@@QEAA@XZ
  3752
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHashTbl@@QEAA@AEBV0@@Z
3760
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHashTbl@@QEAA@AEBV0@@Z
  3948
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHashTbl@@QEAA@XZ
3920
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHashTbl@@QEAA@XZ
  3088
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHashTblAggr@@QEAA@AEBV0@@Z
4052
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHashTblAggr@@QEAA@AEBV0@@Z
  1680
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHashTblAggr@@QEAA@XZ
3224
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHashTblAggr@@QEAA@XZ
  3368
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHeapDispenser@@QEAA@$$QEAV0@@Z
3296
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHeapDispenser@@QEAA@$$QEAV0@@Z
  3652
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHeapDispenser@@QEAA@AEBV0@@Z
3676
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHeapDispenser@@QEAA@AEBV0@@Z
  4024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHeapDispenser@@QEAA@XZ
3980
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CHeapDispenser@@QEAA@XZ
  3204
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CRowsetConnectionPoint@@QEAA@AEBV0@@Z
3344
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CRowsetConnectionPoint@@QEAA@AEBV0@@Z
  3972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CRowsetConnectionPoint@@QEAA@PEAUIUnknown@@PEBU_GUID@@K@Z
3540
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CRowsetConnectionPoint@@QEAA@PEAUIUnknown@@PEBU_GUID@@K@Z
  3756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CRowsetConnectionPointContainer@@QEAA@AEBV0@@Z
3800
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CRowsetConnectionPointContainer@@QEAA@AEBV0@@Z
  3616
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CRowsetConnectionPointContainer@@QEAA@PEAUIUnknown@@@Z
3292
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CRowsetConnectionPointContainer@@QEAA@PEAUIUnknown@@@Z
  3704
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CSlotListLong@@QEAA@AEBV0@@Z
3736
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CSlotListLong@@QEAA@AEBV0@@Z
  3424
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CSlotListLong@@QEAA@XZ
3812
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CSlotListLong@@QEAA@XZ
  3928
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CSlotListShort@@QEAA@AEBV0@@Z
3728
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CSlotListShort@@QEAA@AEBV0@@Z
  4084
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CSlotListShort@@QEAA@XZ
3284
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CSlotListShort@@QEAA@XZ
  4312
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropInfo@@QEAA@AEBV0@@Z
4232
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropInfo@@QEAA@AEBV0@@Z
  4484
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropInfo@@QEAA@XZ
4356
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropInfo@@QEAA@XZ
  4516
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlProps2@@QEAA@AEBV0@@Z
4460
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlProps2@@QEAA@AEBV0@@Z
  4688
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlProps2@@QEAA@K@Z
4680
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlProps2@@QEAA@K@Z
  4840
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropsFastLookup2@@QEAA@$$QEAV0@@Z
4832
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropsFastLookup2@@QEAA@$$QEAV0@@Z
  5084
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropsFastLookup2@@QEAA@AEBV0@@Z
5000
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropsFastLookup2@@QEAA@AEBV0@@Z
  4156
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropsFastLookup2@@QEAA@K@Z
3748
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CUtlPropsFastLookup2@@QEAA@K@Z
  4332
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@AEBV0@@Z
4292
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@AEBV0@@Z
  4628
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@GH@Z
4536
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@GH@Z
  4776
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@PEBD@Z
4764
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@PEBD@Z
  5108
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@PEBE@Z
3608
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@PEBE@Z
  4496
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@PEBG@Z
4212
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@PEBG@Z
  4928
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@PEBGH@Z
4428
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@PEBGH@Z
  5060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@XZ
4896
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0CWString@@QEAA@XZ
  2508
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0IBookmarkObj@@QEAA@AEBV0@@Z
4404
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0IBookmarkObj@@QEAA@AEBV0@@Z
  5076
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0IBookmarkObj@@QEAA@XZ
2488
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0IBookmarkObj@@QEAA@XZ
  4488
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0IHashTbl@@QEAA@AEBV0@@Z
4276
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0IHashTbl@@QEAA@AEBV0@@Z
  4408
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0IHashTbl@@QEAA@XZ
4816
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0IHashTbl@@QEAA@XZ
  5264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0ISlotList@@QEAA@AEBV0@@Z
5188
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0ISlotList@@QEAA@AEBV0@@Z
  5316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0ISlotList@@QEAA@XZ
5360
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?0ISlotList@@QEAA@XZ
  5516
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CBaseObj@@UEAA@XZ
5488
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CBaseObj@@UEAA@XZ
  5660
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CBaseObjBoko@@UEAA@XZ
5652
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CBaseObjBoko@@UEAA@XZ
  5804
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CBaseObjZombie@@UEAA@XZ
5836
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CBaseObjZombie@@UEAA@XZ
  5948
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CBitArray@@QEAA@XZ
6016
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CBitArray@@QEAA@XZ
  5184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CClassFactory@@QEAA@XZ
6124
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CClassFactory@@QEAA@XZ
  5232
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CConnectData@@QEAA@XZ
5220
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CConnectData@@QEAA@XZ
  5560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CEnum@@QEAA@XZ
4396
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CEnum@@QEAA@XZ
  5832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CEnumConnectionPoints@@QEAA@XZ
5744
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CEnumConnectionPoints@@QEAA@XZ
  5984
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CEnumConnections@@QEAA@XZ
5976
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CEnumConnections@@QEAA@XZ
  5224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CExtBuffer@@QEAA@XZ
4508
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CExtBuffer@@QEAA@XZ
  5536
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CHashTbl@@UEAA@XZ
5400
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CHashTbl@@UEAA@XZ
  6132
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CHashTblAggr@@UEAA@XZ
5484
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CHashTblAggr@@UEAA@XZ
  4972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CRowsetConnectionPoint@@QEAA@XZ
5200
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CRowsetConnectionPoint@@QEAA@XZ
  5920
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CRowsetConnectionPointContainer@@QEAA@XZ
5700
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CRowsetConnectionPointContainer@@QEAA@XZ
  5736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CSlotListLong@@UEAA@XZ
5304
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CSlotListLong@@UEAA@XZ
  4652
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CSlotListShort@@UEAA@XZ
5612
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CSlotListShort@@UEAA@XZ
  5588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CUtlPropInfo@@UEAA@XZ
5664
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\003jfb3bb2.dll,t?1CUtlProps2@@UEAA@XZ
2328

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (50 out of 69 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0
IsDebuggerPresent July 18, 2023, 6:03 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

msdatl3.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdbid

One or more processes crashed (42 events)

Time & API	Arguments	Status
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?4CBaseObj@@QEAAAEAV0@AEBV0@@Z+0x40 t?1CBaseObj@@UEAA@XZ-0x40 003jfb3bb2+0x2330 @ 0x180002330 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 89 51 08 48 8d 05 16 11 01 00 33 d2 48 89 01 89 exception.instruction: mov dword ptr [rcx + 8], edx exception.exception_code: 0xc0000005 exception.symbol: t?4CBaseObj@@QEAAAEAV0@AEBV0@@Z+0x40 t?1CBaseObj@@UEAA@XZ-0x40 003jfb3bb2+0x2330 exception.address: 0x180002330 registers.r14: 0 registers.r15: 0 registers.rcx: 196972 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1898752 registers.r11: 1897840 registers.r8: 2409026 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 196972 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CBaseObj@@IEAA@W4EBaseObjectType@@PEAUIUnknown@@PEAJ_N@Z+0x30 tFInit@CBaseObj@@IEAAJXZ-0x10 003jfb3bb2+0x96e0 @ 0x1800096e0 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: f0 41 ff 01 48 8b c1 c3 cc cc cc cc cc cc cc cc exception.instruction: inc dword ptr [r9] exception.exception_code: 0xc0000005 exception.symbol: t?0CBaseObj@@IEAA@W4EBaseObjectType@@PEAUIUnknown@@PEAJ_N@Z+0x30 tFInit@CBaseObj@@IEAAJXZ-0x10 003jfb3bb2+0x96e0 exception.address: 0x1800096e0 registers.r14: 0 registers.r15: 0 registers.rcx: 65910 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1375216 registers.r11: 1374304 registers.r8: 3261034 registers.r9: 10 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 48 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?4CBaseObjBoko@@QEAAAEAV0@AEBV0@@Z+0x130 tIsZombie@CBaseObjZombie@@QEAAHXZ-0x40 003jfb3bb2+0x2520 @ 0x180002520 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 89 51 08 48 8d 05 26 0f 01 00 33 d2 48 89 01 89 exception.instruction: mov dword ptr [rcx + 8], edx exception.exception_code: 0xc0000005 exception.symbol: t?4CBaseObjBoko@@QEAAAEAV0@AEBV0@@Z+0x130 tIsZombie@CBaseObjZombie@@QEAAHXZ-0x40 003jfb3bb2+0x2520 exception.address: 0x180002520 registers.r14: 0 registers.r15: 0 registers.rcx: 131438 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2750608 registers.r11: 2749696 registers.r8: 4768326 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 131438 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CClassFactory@@AEAA@XZ+0x7 t?0CClassFactory@@QEAA@AEBV0@@Z-0x19 003jfb3bb2+0x2127 @ 0x180002127 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: c7 41 08 00 00 00 00 48 89 01 48 8b c1 c3 cc cc exception.instruction: mov dword ptr [rcx + 8], 0 exception.exception_code: 0xc0000005 exception.symbol: t?0CClassFactory@@AEAA@XZ+0x7 t?0CClassFactory@@QEAA@AEBV0@@Z-0x19 003jfb3bb2+0x2127 exception.address: 0x180002127 registers.r14: 0 registers.r15: 0 registers.rcx: 131450 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2031536 registers.r11: 2030624 registers.r8: 2736582 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529672 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CClassFactory@@QEAA@AEBV0@@Z+0x7 t?4CClassFactory@@QEAAAEAV0@AEBV0@@Z-0x29 003jfb3bb2+0x2147 @ 0x180002147 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 8b 42 08 89 41 08 48 8b 42 10 48 89 41 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CClassFactory@@QEAA@AEBV0@@Z+0x7 t?4CClassFactory@@QEAAAEAV0@AEBV0@@Z-0x29 003jfb3bb2+0x2147 exception.address: 0x180002147 registers.r14: 0 registers.r15: 0 registers.rcx: 131444 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2751152 registers.r11: 2750240 registers.r8: 836082 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529672 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CClassFactory@@QEAA@PEAJ0@Z+0x7 t?1CClassFactory@@QEAA@XZ-0x29 003jfb3bb2+0x9d67 @ 0x180009d67 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: c7 41 08 00 00 00 00 48 89 01 48 89 51 10 4c 89 exception.instruction: mov dword ptr [rcx + 8], 0 exception.exception_code: 0xc0000005 exception.symbol: t?0CClassFactory@@QEAA@PEAJ0@Z+0x7 t?1CClassFactory@@QEAA@XZ-0x29 003jfb3bb2+0x9d67 exception.address: 0x180009d67 registers.r14: 0 registers.r15: 0 registers.rcx: 197100 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1113616 registers.r11: 1112704 registers.r8: 2343408 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529672 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CEnum@@QEAA@PEAUIUnknown@@KPEAPEAXU_GUID@@_KKW4CENUMTYPE@@@Z+0x92 t?1CEnum@@QEAA@XZ-0x3e 003jfb3bb2+0x90e2 @ 0x1800090e2 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 8b 01 48 8b 40 08 ff 15 31 ac 00 00 ff c3 41 exception.instruction: mov rax, qword ptr [rcx] exception.exception_code: 0xc0000005 exception.symbol: t?0CEnum@@QEAA@PEAUIUnknown@@KPEAPEAXU_GUID@@_KKW4CENUMTYPE@@@Z+0x92 t?1CEnum@@QEAA@XZ-0x3e 003jfb3bb2+0x90e2 exception.address: 0x1800090e2 registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 2000452688 registers.rbx: 0 registers.rsp: 850320 registers.r11: 1788160 registers.r8: 1788128 registers.r9: 1788144 registers.rdx: 144 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 10 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CEnumConnectionPoints@@QEAA@PEAUIUnknown@@KPEAPEAUIConnectionPoint@@@Z+0x7c t?1CEnumConnectionPoints@@QEAA@XZ-0x64 003jfb3bb2+0x490c @ 0x18000490c rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 8b 0c fa eb 12 48 8b 4b 30 48 0f af c8 8b 43 exception.instruction: mov rcx, qword ptr [rdx + rdi*8] exception.exception_code: 0xc0000005 exception.symbol: t?0CEnumConnectionPoints@@QEAA@PEAUIUnknown@@KPEAPEAUIConnectionPoint@@@Z+0x7c t?1CEnumConnectionPoints@@QEAA@XZ-0x64 003jfb3bb2+0x490c exception.address: 0x18000490c registers.r14: 0 registers.r15: 0 registers.rcx: 2000430304 registers.rsi: 0 registers.r10: 2000452688 registers.rbx: 0 registers.rsp: 1899104 registers.r11: 3230240 registers.r8: 3230208 registers.r9: 3230224 registers.rdx: 10 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CEnumConnections@@QEAA@PEAUIUnknown@@PEAUtagCONNECTDATA@@K@Z+0x94 t?1CEnumConnections@@QEAA@XZ-0x4c 003jfb3bb2+0x4b24 @ 0x180004b24 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 8b 01 48 8b 40 08 ff 15 ef f1 00 00 ff c7 3b exception.instruction: mov rax, qword ptr [rcx] exception.exception_code: 0xc0000005 exception.symbol: t?0CEnumConnections@@QEAA@PEAUIUnknown@@PEAUtagCONNECTDATA@@K@Z+0x94 t?1CEnumConnections@@QEAA@XZ-0x4c 003jfb3bb2+0x4b24 exception.address: 0x180004b24 registers.r14: 0 registers.r15: 0 registers.rcx: -5468495559765786624 registers.rsi: 0 registers.r10: 2000452688 registers.rbx: 0 registers.rsp: 1244992 registers.r11: 2836736 registers.r8: 2836704 registers.r9: 2836720 registers.rdx: 2802306 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CGenericPooler@@QEAA@$$QEAV0@@Z+0x7 t?4CGenericPooler@@QEAAAEAV0@$$QEAV0@@Z-0x19 003jfb3bb2+0x10f7 @ 0x1800010f7 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 42 08 48 89 41 08 48 8b c1 c3 cc exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CGenericPooler@@QEAA@$$QEAV0@@Z+0x7 t?4CGenericPooler@@QEAAAEAV0@$$QEAV0@@Z-0x19 003jfb3bb2+0x10f7 exception.address: 0x1800010f7 registers.r14: 0 registers.r15: 0 registers.rcx: 131752 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2751056 registers.r11: 2750144 registers.r8: 836088 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529168 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CHashTbl@@QEAA@AEBV0@@Z+0x7 t?4CHashTbl@@QEAAAEAV0@AEBV0@@Z-0x39 003jfb3bb2+0x1eb7 @ 0x180001eb7 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 42 08 48 89 41 08 48 8b 42 10 48 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CHashTbl@@QEAA@AEBV0@@Z+0x7 t?4CHashTbl@@QEAAAEAV0@AEBV0@@Z-0x39 003jfb3bb2+0x1eb7 exception.address: 0x180001eb7 registers.r14: 0 registers.r15: 0 registers.rcx: 131784 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1046752 registers.r11: 1045840 registers.r8: 1425864 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529552 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CHashTbl@@QEAA@XZ+0x7 t?1CHashTbl@@UEAA@XZ-0x19 003jfb3bb2+0xb617 @ 0x18000b617 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 33 c0 48 89 41 10 48 89 41 20 48 8b c1 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CHashTbl@@QEAA@XZ+0x7 t?1CHashTbl@@UEAA@XZ-0x19 003jfb3bb2+0xb617 exception.address: 0x18000b617 registers.r14: 0 registers.r15: 0 registers.rcx: 197320 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1965232 registers.r11: 1964320 registers.r8: 3326380 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529552 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CHashTblAggr@@QEAA@AEBV0@@Z+0x7 t?4CHashTblAggr@@QEAAAEAV0@AEBV0@@Z-0x29 003jfb3bb2+0x2017 @ 0x180002017 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 42 08 48 89 41 08 8b 42 10 89 41 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CHashTblAggr@@QEAA@AEBV0@@Z+0x7 t?4CHashTblAggr@@QEAAAEAV0@AEBV0@@Z-0x29 003jfb3bb2+0x2017 exception.address: 0x180002017 registers.r14: 0 registers.r15: 0 registers.rcx: 131782 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1964224 registers.r11: 1963312 registers.r8: 3523056 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529408 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CHeapDispenser@@QEAA@$$QEAV0@@Z+0x7 t?4CHeapDispenser@@QEAAAEAV0@$$QEAV0@@Z-0x19 003jfb3bb2+0x1097 @ 0x180001097 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b c1 c3 cc cc cc cc cc cc cc cc cc exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CHeapDispenser@@QEAA@$$QEAV0@@Z+0x7 t?4CHeapDispenser@@QEAAAEAV0@$$QEAV0@@Z-0x19 003jfb3bb2+0x1097 exception.address: 0x180001097 registers.r14: 0 registers.r15: 0 registers.rcx: 131854 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1505440 registers.r11: 1504528 registers.r8: 3391988 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529168 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CHeapDispenser@@QEAA@$$QEAV0@@Z+0x7 t?4CHeapDispenser@@QEAAAEAV0@$$QEAV0@@Z-0x19 003jfb3bb2+0x1097 @ 0x180001097 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b c1 c3 cc cc cc cc cc cc cc cc cc exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CHeapDispenser@@QEAA@$$QEAV0@@Z+0x7 t?4CHeapDispenser@@QEAAAEAV0@$$QEAV0@@Z-0x19 003jfb3bb2+0x1097 exception.address: 0x180001097 registers.r14: 0 registers.r15: 0 registers.rcx: 197390 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 785408 registers.r11: 784496 registers.r8: 2277832 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529168 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CRowsetConnectionPointContainer@@QEAA@AEBV0@@Z+0x7 t?4CRowsetConnectionPointContainer@@QEAAAEAV0@AEBV0@@Z-0x39 003jfb3bb2+0x4047 @ 0x180004047 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 42 08 48 89 41 08 48 8b 42 10 48 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CRowsetConnectionPointContainer@@QEAA@AEBV0@@Z+0x7 t?4CRowsetConnectionPointContainer@@QEAAAEAV0@AEBV0@@Z-0x39 003jfb3bb2+0x4047 exception.address: 0x180004047 registers.r14: 0 registers.r15: 0 registers.rcx: 131890 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2554880 registers.r11: 2553968 registers.r8: 4637254 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529096 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CSlotListLong@@QEAA@AEBV0@@Z+0x7 t?4CSlotListLong@@QEAAAEAV0@AEBV0@@Z-0x59 003jfb3bb2+0x1a67 @ 0x180001a67 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 42 08 48 89 41 08 48 8b 42 10 48 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CSlotListLong@@QEAA@AEBV0@@Z+0x7 t?4CSlotListLong@@QEAAAEAV0@AEBV0@@Z-0x59 003jfb3bb2+0x1a67 exception.address: 0x180001a67 registers.r14: 0 registers.r15: 0 registers.rcx: 131926 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2751424 registers.r11: 2750512 registers.r8: 4440562 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529432 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CSlotListLong@@QEAA@XZ+0x7 t?1CSlotListLong@@UEAA@XZ-0x29 003jfb3bb2+0xc5e7 @ 0x18000c5e7 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 33 c0 48 89 41 08 48 89 41 28 48 89 41 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CSlotListLong@@QEAA@XZ+0x7 t?1CSlotListLong@@UEAA@XZ-0x29 003jfb3bb2+0xc5e7 exception.address: 0x18000c5e7 registers.r14: 0 registers.r15: 0 registers.rcx: 197464 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2031136 registers.r11: 2030224 registers.r8: 3391942 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529432 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CSlotListShort@@QEAA@AEBV0@@Z+0x7 t?4CSlotListShort@@QEAAAEAV0@AEBV0@@Z-0x79 003jfb3bb2+0x18a7 @ 0x1800018a7 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 42 08 48 89 41 08 48 8b 42 10 48 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CSlotListShort@@QEAA@AEBV0@@Z+0x7 t?4CSlotListShort@@QEAAAEAV0@AEBV0@@Z-0x79 003jfb3bb2+0x18a7 exception.address: 0x1800018a7 registers.r14: 0 registers.r15: 0 registers.rcx: 197462 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2292640 registers.r11: 2291728 registers.r8: 3523060 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529000 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CUtlPropInfo@@QEAA@XZ+0x7 t?1CUtlPropInfo@@UEAA@XZ-0x29 003jfb3bb2+0xe917 @ 0x18000e917 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 33 c0 48 89 41 10 48 89 41 08 48 89 41 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CUtlPropInfo@@QEAA@XZ+0x7 t?1CUtlPropInfo@@UEAA@XZ-0x29 003jfb3bb2+0xe917 exception.address: 0x18000e917 registers.r14: 0 registers.r15: 0 registers.rcx: 131962 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1376128 registers.r11: 1375216 registers.r8: 3260868 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442528912 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CUtlProps2@@QEAA@AEBV0@@Z+0xa t?4CUtlProps2@@QEAAAEAV0@AEBV0@@Z-0x166 003jfb3bb2+0x28ca @ 0x1800028ca rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 4c 8b ca 8b 42 08 89 41 08 8b 42 0c 89 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CUtlProps2@@QEAA@AEBV0@@Z+0xa t?4CUtlProps2@@QEAAAEAV0@AEBV0@@Z-0x166 003jfb3bb2+0x28ca exception.address: 0x1800028ca registers.r14: 0 registers.r15: 0 registers.rcx: 131964 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 786000 registers.r11: 785088 registers.r8: 131964 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529712 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CUtlProps2@@QEAA@AEBV0@@Z+0xa t?4CUtlProps2@@QEAAAEAV0@AEBV0@@Z-0x166 003jfb3bb2+0x28ca @ 0x1800028ca t?0CUtlPropsFastLookup2@@QEAA@$$QEAV0@@Z+0xe t?4CUtlPropsFastLookup2@@QEAAAEAV0@$$QEAV0@@Z-0x22 003jfb3bb2+0x2fce @ 0x180002fce rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 4c 8b ca 8b 42 08 89 41 08 8b 42 0c 89 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CUtlProps2@@QEAA@AEBV0@@Z+0xa t?4CUtlProps2@@QEAAAEAV0@AEBV0@@Z-0x166 003jfb3bb2+0x28ca exception.address: 0x1800028ca registers.r14: 0 registers.r15: 0 registers.rcx: 131434 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2554272 registers.r11: 2553360 registers.r8: 131434 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529712 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CUtlProps2@@QEAA@AEBV0@@Z+0xa t?4CUtlProps2@@QEAAAEAV0@AEBV0@@Z-0x166 003jfb3bb2+0x28ca @ 0x1800028ca t?0CUtlPropsFastLookup2@@QEAA@$$QEAV0@@Z+0xe t?4CUtlPropsFastLookup2@@QEAAAEAV0@$$QEAV0@@Z-0x22 003jfb3bb2+0x2fce @ 0x180002fce rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 4c 8b ca 8b 42 08 89 41 08 8b 42 0c 89 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0CUtlProps2@@QEAA@AEBV0@@Z+0xa t?4CUtlProps2@@QEAAAEAV0@AEBV0@@Z-0x166 003jfb3bb2+0x28ca exception.address: 0x1800028ca registers.r14: 0 registers.r15: 0 registers.rcx: 196652 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2030960 registers.r11: 2030048 registers.r8: 196652 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529712 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CUtlPropsFastLookup2@@QEAA@K@Z+0x2 tGetUPropValIndex@CUtlPropsFastLookup2@@MEAAKKK@Z-0x4e 003jfb3bb2+0x8db2 @ 0x180008db2 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 89 51 0c 89 41 10 89 41 28 89 41 08 48 89 41 20 exception.instruction: mov dword ptr [rcx + 0xc], edx exception.exception_code: 0xc0000005 exception.symbol: t?0CUtlPropsFastLookup2@@QEAA@K@Z+0x2 tGetUPropValIndex@CUtlPropsFastLookup2@@MEAAKKK@Z-0x4e 003jfb3bb2+0x8db2 exception.address: 0x180008db2 registers.r14: 0 registers.r15: 0 registers.rcx: 196646 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 982816 registers.r11: 981904 registers.r8: 1491446 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: tAllocBuffer@CWString@@IEAAXH@Z+0x55 tEmpty@CWString@@QEAAXXZ-0x6b 003jfb3bb2+0xa015 @ 0x18000a015 t?0CWString@@QEAA@PEBD@Z+0x5c tAssignCopy@CWString@@IEAAXHPEBG@Z-0x74 003jfb3bb2+0xa29c @ 0x18000a29c rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 03 48 85 c0 75 1e 48 8d 05 cc 36 01 00 c6 exception.instruction: mov qword ptr [rbx], rax exception.exception_code: 0xc0000005 exception.symbol: tAllocBuffer@CWString@@IEAAXH@Z+0x55 tEmpty@CWString@@QEAAXXZ-0x6b 003jfb3bb2+0xa015 exception.address: 0x18000a015 registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 285 registers.rbx: 0 registers.rsp: 1048320 registers.r11: 1 registers.r8: 29 registers.r9: 314 registers.rdx: 31473120 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 31473120 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0CWString@@QEAA@PEBE@Z+0x8 t?4CWString@@QEAAAEBV0@PEBE@Z-0x38 003jfb3bb2+0x11d8 @ 0x1800011d8 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: c6 41 10 00 48 89 41 08 48 8b d9 48 8d 05 06 c5 exception.instruction: mov byte ptr [rcx + 0x10], 0 exception.exception_code: 0xc0000005 exception.symbol: t?0CWString@@QEAA@PEBE@Z+0x8 t?4CWString@@QEAAAEBV0@PEBE@Z-0x38 003jfb3bb2+0x11d8 exception.address: 0x1800011d8 registers.r14: 0 registers.r15: 0 registers.rcx: 197612 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2554000 registers.r11: 2553088 registers.r8: 4506052 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: tAllocBuffer@CWString@@IEAAXH@Z+0x55 tEmpty@CWString@@QEAAXXZ-0x6b 003jfb3bb2+0xa015 @ 0x18000a015 t?0CWString@@QEAA@PEBG@Z+0x36 t?0CWString@@QEAA@PEBD@Z-0x5a 003jfb3bb2+0xa1e6 @ 0x18000a1e6 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 03 48 85 c0 75 1e 48 8d 05 cc 36 01 00 c6 exception.instruction: mov qword ptr [rbx], rax exception.exception_code: 0xc0000005 exception.symbol: tAllocBuffer@CWString@@IEAAXH@Z+0x55 tEmpty@CWString@@QEAAXXZ-0x6b 003jfb3bb2+0xa015 exception.address: 0x18000a015 registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 285 registers.rbx: 0 registers.rsp: 1245056 registers.r11: 1 registers.r8: 29 registers.r9: 314 registers.rdx: 31407584 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 31407584 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: tAllocBuffer@CWString@@IEAAXH@Z+0x55 tEmpty@CWString@@QEAAXXZ-0x6b 003jfb3bb2+0xa015 @ 0x18000a015 t?0CWString@@QEAA@PEBGH@Z+0x4c t?4CWString@@QEAAAEBV0@G@Z-0x34 003jfb3bb2+0xac8c @ 0x18000ac8c rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 03 48 85 c0 75 1e 48 8d 05 cc 36 01 00 c6 exception.instruction: mov qword ptr [rbx], rax exception.exception_code: 0xc0000005 exception.symbol: tAllocBuffer@CWString@@IEAAXH@Z+0x55 tEmpty@CWString@@QEAAXXZ-0x6b 003jfb3bb2+0xa015 exception.address: 0x18000a015 registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1833616 registers.r11: 514 registers.r8: 30671128 registers.r9: 1829856 registers.rdx: 40304640 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 40304704 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0IBookmarkObj@@QEAA@AEBV0@@Z+0x7 t?1IHashTbl@@UEAA@XZ-0xd9 003jfb3bb2+0x1c67 @ 0x180001c67 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b c1 c3 cc cc cc cc cc cc cc cc cc exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0IBookmarkObj@@QEAA@AEBV0@@Z+0x7 t?1IHashTbl@@UEAA@XZ-0xd9 003jfb3bb2+0x1c67 exception.address: 0x180001c67 registers.r14: 0 registers.r15: 0 registers.rcx: 132204 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1112192 registers.r11: 1111280 registers.r8: 1360324 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529136 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0IHashTbl@@QEAA@AEBV0@@Z+0x7 tAdjustRange@CHashTbl@@CAKK@Z-0xd9 003jfb3bb2+0x1d67 @ 0x180001d67 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b c1 c3 cc cc cc cc cc cc cc cc cc exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0IHashTbl@@QEAA@AEBV0@@Z+0x7 tAdjustRange@CHashTbl@@CAKK@Z-0xd9 003jfb3bb2+0x1d67 exception.address: 0x180001d67 registers.r14: 0 registers.r15: 0 registers.rcx: 197740 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1703248 registers.r11: 1702336 registers.r8: 2605484 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529528 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?0ISlotList@@QEAA@AEBV0@@Z+0x7 t?0CSlotListShort@@QEAA@AEBV0@@Z-0xd9 003jfb3bb2+0x17c7 @ 0x1800017c7 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b c1 c3 cc cc cc cc cc cc cc cc cc exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?0ISlotList@@QEAA@AEBV0@@Z+0x7 t?0CSlotListShort@@QEAA@AEBV0@@Z-0xd9 003jfb3bb2+0x17c7 exception.address: 0x1800017c7 registers.r14: 0 registers.r15: 0 registers.rcx: 132208 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 850144 registers.r11: 849232 registers.r8: 2605514 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529576 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CBaseObj@@UEAA@XZ+0x7 tMakeZombies@CBaseObjBoko@@QEAAXXZ-0x39 003jfb3bb2+0x2377 @ 0x180002377 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 41 10 f0 ff 08 80 79 20 00 74 16 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?1CBaseObj@@UEAA@XZ+0x7 tMakeZombies@CBaseObjBoko@@QEAAXXZ-0x39 003jfb3bb2+0x2377 exception.address: 0x180002377 registers.r14: 0 registers.r15: 0 registers.rcx: 132276 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1637280 registers.r11: 1636368 registers.r8: 3785132 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529872 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CBaseObj@@UEAA@XZ+0xe tMakeZombies@CBaseObjBoko@@QEAAXXZ-0x32 003jfb3bb2+0x237e @ 0x18000237e rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: f0 ff 08 80 79 20 00 74 16 48 83 c1 18 48 83 39 exception.instruction: dec dword ptr [rax] exception.exception_code: 0xc0000005 exception.symbol: t?1CBaseObj@@UEAA@XZ+0xe tMakeZombies@CBaseObjBoko@@QEAAXXZ-0x32 003jfb3bb2+0x237e exception.address: 0x18000237e registers.r14: 0 registers.r15: 0 registers.rcx: 66744 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2160704 registers.r11: 2159792 registers.r8: 3916228 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CBaseObj@@UEAA@XZ+0x7 tMakeZombies@CBaseObjBoko@@QEAAXXZ-0x39 003jfb3bb2+0x2377 @ 0x180002377 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 41 10 f0 ff 08 80 79 20 00 74 16 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?1CBaseObj@@UEAA@XZ+0x7 tMakeZombies@CBaseObjBoko@@QEAAXXZ-0x39 003jfb3bb2+0x2377 exception.address: 0x180002377 registers.r14: 0 registers.r15: 0 registers.rcx: 132280 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1899824 registers.r11: 1898912 registers.r8: 2081224 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529872 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CClassFactory@@QEAA@XZ+0xe tQueryInterface@CClassFactory@@UEAAJAEBU_GUID@@PEAPEAX@Z-0x12 003jfb3bb2+0x9d9e @ 0x180009d9e rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: f0 ff 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc exception.instruction: dec dword ptr [rax] exception.exception_code: 0xc0000005 exception.symbol: t?1CClassFactory@@QEAA@XZ+0xe tQueryInterface@CClassFactory@@UEAAJAEBU_GUID@@PEAPEAX@Z-0x12 003jfb3bb2+0x9d9e exception.address: 0x180009d9e registers.r14: 0 registers.r15: 0 registers.rcx: 66776 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 915776 registers.r11: 914864 registers.r8: 2867654 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CEnumConnections@@QEAA@XZ+0x7 tClone@CEnumConnections@@UEAAJPEAPEAUIEnumConnections@@@Z-0x19 003jfb3bb2+0x4b77 @ 0x180004b77 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 83 c1 08 e9 9d 45 00 00 cc cc cc cc exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?1CEnumConnections@@QEAA@XZ+0x7 tClone@CEnumConnections@@UEAAJPEAPEAUIEnumConnections@@@Z-0x19 003jfb3bb2+0x4b77 exception.address: 0x180004b77 registers.r14: 0 registers.r15: 0 registers.rcx: 132352 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2553888 registers.r11: 2552976 registers.r8: 3588556 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442528856 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2 @ 0x773540f2 EtwEnumerateProcessRegGuids+0x216 RtlTraceDatabaseLock-0x2a ntdll+0xc4736 @ 0x77354736 RtlQueryProcessLockInformation+0x972 RtlTraceDatabaseEnumerate-0xe ntdll+0xc5942 @ 0x77355942 RtlLogStackBackTrace+0x444 RtlTraceDatabaseCreate-0x4ec ntdll+0xc75f4 @ 0x773575f4 RtlIsDosDeviceName_U+0x14237 NtdllDialogWndProc_A-0x1a535 ntdll+0x6dcb7 @ 0x772fdcb7 HeapFree+0xa BaseSetLastNTError-0x16 kernel32+0x2307a @ 0x7719307a mpFree+0x18 UMSEnterCSWraper-0x48 msdart+0x1078 @ 0x7fef43c1078 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: eb 00 48 8b 9c 24 d0 00 00 00 48 81 c4 c0 00 00 exception.symbol: RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2 exception.instruction: jmp 0x773540f4 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 803058 exception.address: 0x773540f2 registers.r14: 0 registers.r15: 0 registers.rcx: 1307968 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1310640 registers.r11: 646 registers.r8: 9031248857632415237 registers.r9: 1610357124 registers.rdx: 2000467024 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1999519588 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CHashTbl@@UEAA@XZ+0x11 tFInit@CHashTbl@@QEAAHGPEAVCSlotListShort@@PEAVIBookmarkObj@@@Z-0x4f 003jfb3bb2+0xb641 @ 0x18000b641 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b d9 48 85 d2 74 24 48 8b 0d b5 20 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?1CHashTbl@@UEAA@XZ+0x11 tFInit@CHashTbl@@QEAAHGPEAVCSlotListShort@@PEAVIBookmarkObj@@@Z-0x4f 003jfb3bb2+0xb641 exception.address: 0x18000b641 registers.r14: 0 registers.r15: 0 registers.rcx: 263424 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1178448 registers.r11: 1177536 registers.r8: 2212268 registers.r9: 10 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529552 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CHashTblAggr@@UEAA@XZ+0x10 tFInit@CHashTblAggr@@QEAAHPEAVCHashTbl@@@Z-0x80 003jfb3bb2+0xba00 @ 0x18000ba00 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 49 08 48 85 c9 74 54 48 89 5c 24 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?1CHashTblAggr@@UEAA@XZ+0x10 tFInit@CHashTblAggr@@QEAAHPEAVCHashTbl@@@Z-0x80 003jfb3bb2+0xba00 exception.address: 0x18000ba00 registers.r14: 0 registers.r15: 0 registers.rcx: 132350 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1113008 registers.r11: 1112096 registers.r8: 2277828 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529408 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CRowsetConnectionPoint@@QEAA@XZ+0x23 tAdvise@CRowsetConnectionPoint@@UEAAJPEAUIUnknown@@PEAK@Z-0xed 003jfb3bb2+0x4e93 @ 0x180004e93 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 83 79 30 00 74 29 0f 1f 00 48 8b 43 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?1CRowsetConnectionPoint@@QEAA@XZ+0x23 tAdvise@CRowsetConnectionPoint@@UEAAJPEAUIUnknown@@PEAK@Z-0xed 003jfb3bb2+0x4e93 exception.address: 0x180004e93 registers.r14: 0 registers.r15: 0 registers.rcx: 197886 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2424656 registers.r11: 2423744 registers.r8: 3260920 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442528792 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CSlotListLong@@UEAA@XZ+0x11 tFInit@CSlotListLong@@UEAAH_KPEAPEAVISlotList@@PEAPEAVIHashTbl@@0@Z-0x8f 003jfb3bb2+0xc621 @ 0x18000c621 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b f9 48 85 d2 74 6c 48 89 5c 24 30 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?1CSlotListLong@@UEAA@XZ+0x11 tFInit@CSlotListLong@@UEAAH_KPEAPEAVISlotList@@PEAPEAVIHashTbl@@0@Z-0x8f 003jfb3bb2+0xc621 exception.address: 0x18000c621 registers.r14: 0 registers.r15: 0 registers.rcx: 263422 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1702288 registers.r11: 1701376 registers.r8: 3850694 registers.r9: 10 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529432 registers.r13: 0	1
__exception__ July 18, 2023, 6:03 p.m.	stacktrace: t?1CSlotListShort@@UEAA@XZ+0x10 tFInit@CSlotListShort@@UEAAH_KPEAPEAVISlotList@@PEAPEAVIHashTbl@@0@Z-0xa0 003jfb3bb2+0xbd60 @ 0x18000bd60 rundll32+0x2f42 @ 0xfff12f42 rundll32+0x3b7a @ 0xfff13b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 89 01 48 8b 49 38 48 85 c9 74 7a 48 8b 47 60 exception.instruction: mov qword ptr [rcx], rax exception.exception_code: 0xc0000005 exception.symbol: t?1CSlotListShort@@UEAA@XZ+0x10 tFInit@CSlotListShort@@UEAAH_KPEAPEAVISlotList@@PEAPEAVIHashTbl@@0@Z-0xa0 003jfb3bb2+0xbd60 exception.address: 0x18000bd60 registers.r14: 0 registers.r15: 0 registers.rcx: 132388 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1834528 registers.r11: 1833616 registers.r8: 2474440 registers.r9: 10 registers.rdx: 4293984256 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 6442529000 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 69 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 1328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2844 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3028 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 3928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 5084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 5108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 5060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 2508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 5076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 18, 2023, 6:03 p.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00005000', u'virtual_address': u'0x00020000', u'entropy': 7.313508673846623, u'name': u'.rsrc', u'virtual_size': u'0x000046d7'}

entropy

7.31350867385

description

A section with a high entropy has been found

003jfb3bb2.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All