Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 25, 2023, 7:33 a.m.	July 25, 2023, 7:35 a.m.

Size	390.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0cca805bb1bb946b8683dd3cfdaed406`
SHA256	`138a59b782027668c65454c0e1f6d848163f0880071229ac425759e64ddb4303`
CRC32	`9E0347E7`
ssdeep	`6144:KHy+bnr+3p0yN90QEJKLvby+VzJ8b9Ue/PLvGu2VdZepW3eLIH7bR68gmb+:RMrzy90Hcv8b2CPjGXVOp8N968Q`
PDB Path	wextract.pdb
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet IsPE32 - (no description)

lega.exe "C:\Users\test22\AppData\Local\Temp\lega.exe"
2548
- z8234926.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\z8234926.exe
  2600
  - p1559830.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\p1559830.exe
    2668
  - r4336554.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\r4336554.exe
    2868
    - legola.exe "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe"
      2976
      - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe" /F
        1152
      - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "test22:N"&&CACLS "legola.exe" /P "test22:R" /E&&echo Y|CACLS "..\ebb444342c" /P "test22:N"&&CACLS "..\ebb444342c" /P "test22:R" /E&&Exit
        2112
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        148
        
        cacls.exe CACLS "legola.exe" /P "test22:N"
        2236
        
        cacls.exe CACLS "legola.exe" /P "test22:R" /E
        2312
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2492
        
        cacls.exe CACLS "..\ebb444342c" /P "test22:N"
        2540
        
        cacls.exe CACLS "..\ebb444342c" /P "test22:R" /E
        2632
      - LummaC2.exe "C:\Users\test22\AppData\Local\Temp\1000002001\LummaC2.exe"
        2780
      - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        2744
- t4577766.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\t4577766.exe
  3024
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
westwork-my.xyz	A 172.67.173.193 A 104.21.72.18	104.21.72.18
bitbucket.org	A 104.192.141.1	104.192.141.1

IP Address	Status	Action
104.192.141.1	Active	Moloch
104.21.72.18	Active	Moloch
164.124.101.2	Active	Moloch
5.42.92.67	Active	Moloch
77.91.68.68	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043233	ET MALWARE RedLine Stealer TCP CnC net.tcp Init	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 104.192.141.1:443 -> 192.168.56.101:49182	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 77.91.68.68:19071 -> 192.168.56.101:49176	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.101:49182 -> 104.192.141.1:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49180 -> 5.42.92.67:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49180 -> 5.42.92.67:80	2044623	ET MALWARE Amadey Bot Activity (POST)	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49190 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49178 -> 5.42.92.67:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 5.42.92.67:80	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	A Network Trojan was detected
TCP 192.168.56.101:49178 -> 5.42.92.67:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.101:49178 -> 5.42.92.67:80	2044623	ET MALWARE Amadey Bot Activity (POST)	A Network Trojan was detected
TCP 192.168.56.101:49192 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49178 -> 5.42.92.67:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.101:49204 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49212 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 104.192.141.1:443 -> 192.168.56.101:49184	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 5.42.92.67:80 -> 192.168.56.101:49178	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 5.42.92.67:80 -> 192.168.56.101:49178	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 5.42.92.67:80 -> 192.168.56.101:49178	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49215 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49216 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49191 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49220 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49176 -> 77.91.68.68:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49200 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49226 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49196 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49202 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49199 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49205 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49207 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49195 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49198 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 104.192.141.1:443 -> 192.168.56.101:49183	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49183 -> 104.192.141.1:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49209 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49217 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49211 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49223 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49213 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49227 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49218 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49180 -> 5.42.92.67:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 5.42.92.67:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.101:49193 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 5.42.92.67:80 -> 192.168.56.101:49180	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 5.42.92.67:80 -> 192.168.56.101:49180	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.101:49194 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49197 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49201 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 5.42.92.67:80 -> 192.168.56.101:49180	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity
TCP 192.168.56.101:49203 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49206 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49208 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49210 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49222 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49225 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49214 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49228 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49219 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49221 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49230 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49224 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected
TCP 192.168.56.101:49229 -> 104.21.72.18:80	2043206	ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (14 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 25, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 7:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 25, 2023, 7:34 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 25, 2023, 7:26 a.m.			0	0
IsDebuggerPresent July 25, 2023, 7:26 a.m.			0	0
IsDebuggerPresent July 25, 2023, 7:33 a.m.			0	0
IsDebuggerPresent July 25, 2023, 7:33 a.m.			0	0
IsDebuggerPresent July 25, 2023, 7:34 a.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 25, 2023, 7:33 a.m.	buffer: SUCCESS: The scheduled task "legola.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2023, 7:33 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW July 25, 2023, 7:33 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA July 25, 2023, 7:33 a.m.	buffer: r console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (17 events)

Time & API	Arguments	Status	Return
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaef0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaeb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaeb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaeb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaeb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaeb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaeb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaeb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaf30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eaf30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb0f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 7:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 25, 2023, 7:26 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (26 events)

Time & API	Arguments	Status
__exception__ July 25, 2023, 7:33 a.m.	stacktrace: 0xb99841 0xb99643 0xb97710 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb99978 registers.esp: 1895956 registers.edi: 1896008 registers.eax: 0 registers.ebp: 1896020 registers.edx: 4954088 registers.ebx: 1897460 registers.esi: 42572268 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f88059 0x4f87eba 0x4f87d8d 0x4f86643 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894196 registers.edi: 1894496 registers.eax: 0 registers.ebp: 1894508 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 43388420 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f88624 0x4f87eba 0x4f87d8d 0x4f86643 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894484 registers.edi: 1894828 registers.eax: 0 registers.ebp: 1894492 registers.edx: 0 registers.ebx: 1897460 registers.esi: 43388420 registers.ecx: 44638004	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f88059 0x4f87eba 0x4f87da5 0x4f86643 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894196 registers.edi: 1894496 registers.eax: 0 registers.ebp: 1894508 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 43388420 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f88624 0x4f87eba 0x4f87da5 0x4f86643 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894484 registers.edi: 1894828 registers.eax: 0 registers.ebp: 1894492 registers.edx: 0 registers.ebx: 1897460 registers.esi: 43388420 registers.ecx: 42278748	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f88059 0x4f87eba 0x4f87da5 0x4f86643 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894196 registers.edi: 1894496 registers.eax: 0 registers.ebp: 1894508 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f88624 0x4f87eba 0x4f87da5 0x4f86643 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894484 registers.edi: 1894828 registers.eax: 0 registers.ebp: 1894492 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 43719132	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8cb48 0x4f8c999 0x4f87d8d 0x4f8692c 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894172 registers.edi: 1894472 registers.eax: 0 registers.ebp: 1894484 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8d0de 0x4f8c999 0x4f87d8d 0x4f8692c 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894460 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894468 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 45154004	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8cb48 0x4f8c999 0x4f87da5 0x4f8692c 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894172 registers.edi: 1894472 registers.eax: 0 registers.ebp: 1894484 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8d0de 0x4f8c999 0x4f87da5 0x4f8692c 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894460 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894468 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 46503692	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8cb48 0x4f8c999 0x4f87da5 0x4f8692c 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894172 registers.edi: 1894472 registers.eax: 0 registers.ebp: 1894484 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8d0de 0x4f8c999 0x4f87da5 0x4f8692c 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894460 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894468 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 47853380	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8d482 0x4f8d291 0x4f87d8d 0x4f86a44 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894224 registers.edi: 1894524 registers.eax: 0 registers.ebp: 1894536 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8d8ea 0x4f8d291 0x4f87d8d 0x4f86a44 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894512 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894520 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42236384 registers.ecx: 42882440	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8d482 0x4f8d291 0x4f87da5 0x4f86a44 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894224 registers.edi: 1894524 registers.eax: 0 registers.ebp: 1894536 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8d8ea 0x4f8d291 0x4f87da5 0x4f86a44 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894512 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894520 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 44373236	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8d482 0x4f8d291 0x4f87da5 0x4f86a44 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894224 registers.edi: 1894524 registers.eax: 0 registers.ebp: 1894536 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8d8ea 0x4f8d291 0x4f87da5 0x4f86a44 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894512 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894520 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 45863744	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8dd5c 0x4f8db79 0x4f87d8d 0x4f86b4a 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894256 registers.edi: 1894556 registers.eax: 0 registers.ebp: 1894568 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8e11c 0x4f8db79 0x4f87d8d 0x4f86b4a 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894544 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894552 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 42870928	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8dd5c 0x4f8db79 0x4f87da5 0x4f86b4a 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894256 registers.edi: 1894556 registers.eax: 0 registers.ebp: 1894568 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8e11c 0x4f8db79 0x4f87da5 0x4f86b4a 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894544 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894552 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 44364020	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8dd5c 0x4f8db79 0x4f87da5 0x4f86b4a 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 39 09 ff 15 34 cb 65 02 89 85 04 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f88c9a registers.esp: 1894256 registers.edi: 1894556 registers.eax: 0 registers.ebp: 1894568 registers.edx: 40225048 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 0	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8e11c 0x4f8db79 0x4f87da5 0x4f86b4a 0x4f857d9 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1894544 registers.edi: 1894852 registers.eax: 0 registers.ebp: 1894552 registers.edx: 0 registers.ebx: 1897460 registers.esi: 42217640 registers.ecx: 45856824	1
__exception__ July 25, 2023, 7:34 a.m.	stacktrace: 0x4f8c5d0 0x4f8f4a3 0x4f8ea4e 0x4f85831 0xb9d9ff 0xb97855 0xb96f0b 0xb93c6b 0xb935d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72652652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7266264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72662e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727174ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72717610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x727a1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x727a1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x727a1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x727a416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7232f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72df7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72df4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4f8c613 registers.esp: 1895364 registers.edi: 1895628 registers.eax: 0 registers.ebp: 1895372 registers.edx: 0 registers.ebx: 1897460 registers.esi: 46398508 registers.ecx: 46405484	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (7 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://5.42.92.67/norm/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://5.42.92.67/lend/http://5.42.92.67/lend/dewrww7a1z.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://5.42.92.67/lend/LummaC2.exe
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://westwork-my.xyz/c2conf
suspicious_features	POST method with no referer header	suspicious_request	POST http://westwork-my.xyz/c2sock
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://5.42.92.67/norm/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://5.42.92.67/norm/Plugins/clip64.dll

Performs some HTTP requests (8 events)

request	POST http://5.42.92.67/norm/index.php
request	GET http://5.42.92.67/lend/http://5.42.92.67/lend/dewrww7a1z.exe
request	GET http://5.42.92.67/lend/LummaC2.exe
request	GET http://westwork-my.xyz/
request	POST http://westwork-my.xyz/c2conf
request	POST http://westwork-my.xyz/c2sock
request	GET http://5.42.92.67/norm/Plugins/cred64.dll
request	GET http://5.42.92.67/norm/Plugins/clip64.dll

Sends data using the HTTP POST Method (3 events)

request	POST http://5.42.92.67/norm/index.php
request	POST http://westwork-my.xyz/c2conf
request	POST http://westwork-my.xyz/c2sock

Allocates read-write-execute memory (usually to unpack itself) (50 out of 174 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 25, 2023, 7:33 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:33 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:33 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:33 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4ee3000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002090000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef406a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3985000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef406b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef39d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9425a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9430c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94336000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9426c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2316000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefeffd000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94381000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9427b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9427d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9426a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94382000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9425b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 25, 2023, 7:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2120000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

legola.exe tried to sleep 141 seconds, actually delayed analysis time by 141 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW July 25, 2023, 7:33 a.m.	number_of_free_clusters: 3252944 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW July 25, 2023, 7:33 a.m.	number_of_free_clusters: 3252944 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW July 25, 2023, 7:33 a.m.	number_of_free_clusters: 3252841 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW July 25, 2023, 7:33 a.m.	number_of_free_clusters: 3252841 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (50 out of 66 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000004.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj

Creates executable files on the filesystem (8 events)

file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll
file	C:\Users\test22\AppData\Local\Temp\1000001001\dewrww7a1z.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\z8234926.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\r4336554.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\t4577766.exe
file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\p1559830.exe
file	C:\Users\test22\AppData\Local\Temp\1000002001\LummaC2.exe

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "legola.exe" /P "test22:N"&&CACLS "legola.exe" /P "test22:R" /E&&echo Y\|CACLS "..\ebb444342c" /P "test22:N"&&CACLS "..\ebb444342c" /P "test22:R" /E&&Exit
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe
file	C:\Users\test22\AppData\Local\Temp\1000002001\LummaC2.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe
file	C:\Users\test22\AppData\Local\Temp\1000002001\LummaC2.exe
file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW July 25, 2023, 7:33 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe	1	1
ShellExecuteExW July 25, 2023, 7:33 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW July 25, 2023, 7:33 a.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "legola.exe" /P "test22:N"&&CACLS "legola.exe" /P "test22:R" /E&&echo Y\|CACLS "..\ebb444342c" /P "test22:N"&&CACLS "..\ebb444342c" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW July 25, 2023, 7:33 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000002001\LummaC2.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000002001\LummaC2.exe	1	1
ShellExecuteExW July 25, 2023, 7:34 a.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main filepath: rundll32.exe	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 events)

Time & API	Arguments	Status	Return
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x000003a0 process_name: TrustedInstaller.exe process_identifier: 2752	1	1
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x000003a0 process_name: LummaC2.exe process_identifier: 2780	1	1
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x000003a0 process_name: WmiPrvSE.exe process_identifier: 1796	1	1
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000454 process_name: taskhost.exe process_identifier: 2072	1	1

An executable file was downloaded by the process legola.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile July 25, 2023, 7:33 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL=)»dà:àL+@@@ß T(À@â.textá8: `.rdatat¦P¨>@@.dataæ@À.relocT @BUåUkÒÑéU SùuñìEdÀÿÒì]ÃUåäð>@3ì]ÃARQRAPAQAVAWATASAUIÇÂIÇÆDUDuHÇÁHÇÂIÇÀIÇÁA AREBEJIþIþ~#MôIìMkäIìIÇÃG\"ASIüuèEIÊHì(HÄ(IþIþ~MóIëMkÛLÜA]A[A\A_A^AYAXZYAZËUåUkÒÑéU SùuñìEèì]Ãâ4ÃÌUSWVP\|$\$l$ ,$èLÉ1öNUjSVWÿpQèÖNÄÀyðÄ^_[]ÃWVL$è$ÀtÆPè½ÄÇVÿFÄøë1À^_ÃUSWVhTEQè¦ËÄ1öÀtuÇjjPèÉ¯ÄWè³ÄÀxPÅWènçÄEPÿFÄÀt4ÃWUjPèÊÝÄÀtÅWèÙÄÀt"Wèv×ÄSÿFëWèd×Äð^_[]ÃWèT×ÄÆ+ÞëèD$Àt$8ïux»u x¿uÀD$L$1ÒèÃ1ÀÃUSWVúv1À^_[]Ã×Î)¶]Sè]âÄÀtE.¶]SèIâÄEÀuì¾ÃøZHÐù s-ñ^_[]é¬Nøm~)ønt=øtt-ø{uGñú^_[]éìJø"t+ø-tÉëø[tøfvÿÿÿñ^_[]éNñ^_[]éïNñ^_[]éÆMGñú^_[]éxLVÎQèéÄñÂ^éWVt$öt \|$ÿtWèíèÄñúPè Äë1À^_ÃUSWVP1öÉt@ÓÒt:ÏT$Ùè@åÇEùÚUPÿt$ è]Ä}tOW4ðÄ^_[]Ãÿt$ÿt$èoÿÿÿÄPèÄÃL$è²ÀtÃ1ÀÃL$èÀt@Ã1ÀÃÿt$ÿt$è.ÿÿÿÄPèÄÃVt$VèþÄÙîøuÝØÝF^ÃVt$VèâÄÁ1ÀùuF^Ãÿt$ÿt$èÜþÿÿÄPèÄÃVt$Vè¬ÄÁ1ÀùuF^Ãÿt$ÿt$è¦þÿÿÄPèÄÃVt$VèvÄøuFë1ÀH^ÃSWV\|$t$j.WèGÄÀt2ÃØ)øñúPèþÿÿÄPèDÿÿÿÄÆßGj.WèîFÄÃÀuÐWVè)þÿÿÄ^_[Ãÿt$ÿt$èÿÿÿÄPèªþÿÿÄÃÿt$ÿt$èÿÿÿÄPè£þÿÿÄÃÿt$ÿt$èeÿÿÿÄPèÓþÿÿÄÃD$Àt@Ã1ÀÃSWV\|$1öÿt\$WèÚÿÿÿÄ9ØvG4ð^_[ÃSWV\|$1öÿt\$Wè°ÿÿÿÄ9ØvG4ð^_[ÃD$ÀtÃ1ÀÃÿt$ÿt$èVýÿÿÄ1ÉÀÁÈÃVÿt$ÿt$è;ýÿÿÄÀtt$PèÄÁ1À9ñÀë1À^ÃD$Àt@Ã1ÀHÃSWV\|$1öÿt\$WèÄ9ØvG4ð^_[ÃD$Àt@Ã1ÀÃÿt$ÿt$èºÿÿÿÄPè´ýÿÿÄÃD$ÀtÃ1ÀÃVÎQèÿÿÿÄøt1öëÆð^ÃVt$VèhÿÿÿÄøtøtøu NèëÿvÿFÄëNè#^ÿ%FVÎ1ÒBjèOÄVÿFÄ^ÃWVÎyt1ÿFÿ4¸èÿÿÿÄG;~rìÿvÿFÄVÿFÄ^_ÃWVjÿFÄ1öÀt+ÇÇÇ@ÁèGÀtþë WÿFÄð^_ÃWVÎj$ÿFÄÀtÇ01öÁ1ÒèOÀtWÿFÄë1öëþð^_ÃWVjÿFÄ1öÀt+ÇÇÇ@ÁèGÀtþë WÿFÄð^_ÃVÎjÿFÄÀt 01ÉHHH^ÃVt$ötVèäÄPVè Ä^Ã1À^ÃSWV\$1öÛt;\|$Ùúè4ÀtÙúèdÀtÃÁúèÆÀuSÿFÄ1öð^_[ÃUSWVPÇ$1öFÒ~ ×ËÏåÙêèÁOÀu $9ûrìë1öðÄ^_[]ÃSWVÓÏBPÿFÄÆÀtÆSWVè6Äð^_[ÃWVÖÏjÿFÄÀtÇÇ@xp^_ÃVìÝD$ÝT$Ý$èI§1öføt?ÝD$Ý$è5§føt-ÝD$ÝØÇ$ÿFÀtÇÇ@ÝD$ÝXÆðÄ^ÃjÿFÄÀtL$ÇÇ@1ÒÉÂPÃjÿFÄÀt ÇÇ@ÃWV×ÎQ9QrÒúsºñèÏKÀt1ÀHëVèxüÿÿÄFN<ÿF1À^_ÃUSWVP1ÀHÉÁ×Ò·\|$¬ÎWèïáÄÃùÂèi ÅàÇñúPUSÃè Ä;t1ÀHëqN;Nr+ñè À¸ÿÿÿÿuYWèáÄñúSUPèL ÄNV<NVNV\|$<NVFN,ÿFVèÜúÿÿÄ1ÀÄ^_[]ÃVì@L$Hà1ö1ÒPVVèÄÀx@ÆðÄ@^ÃUSWVì×Î1íMQèëúÿÿÄHøi\$0ÿ$UEùºTEéxVèwøÿÿÄÀAÃVèwøÿÿÄÙÂWèçNÄéOVèøÿÿÄÿtû ÐF¸)TEÉtÈìÝ\$D$$è_õÿÿÄéVèkøÿÿÄD$PèùÿÿÄÃùº!TEè'NÀ½ request_handle: 0x00cc000c	1	1	0
InternetReadFile July 25, 2023, 7:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPELUm¾dà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëè*YÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00059200', u'virtual_address': u'0x0000c000', u'entropy': 7.807691437881516, u'name': u'.rsrc', u'virtual_size': u'0x0005a000'}

entropy

7.80769143788

description

A section with a high entropy has been found

entropy

0.916452442159

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 25, 2023, 7:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 25, 2023, 7:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (9 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000454 process_name: taskhost.exe process_identifier: 2072		0	0
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000448 process_name: taskhost.exe process_identifier: 2072		0	0
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000454 process_name: taskhost.exe process_identifier: 2072		0	0
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000448 process_name: taskhost.exe process_identifier: 2072		0	0
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000454 process_name: taskhost.exe process_identifier: 2072		0	0
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000448 process_name: taskhost.exe process_identifier: 2072		0	0
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000454 process_name: taskhost.exe process_identifier: 2072		0	0
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000448 process_name: taskhost.exe process_identifier: 2072		0	0
Process32NextW July 25, 2023, 7:34 a.m.	snapshot_handle: 0x00000454 process_name: taskhost.exe process_identifier: 2072		0	0

Queries for potentially installed applications (50 out of 78 events)

Time & API	Arguments	Status
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000003b4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: AddressBook base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: Connection Manager base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: DirectDrawEx base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: EditPlus base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: ENTERPRISE base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: Fontcore base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: Google Chrome base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: IE40 base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: IE4Data base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: IE5BAKEX base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: IEData base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: MobileOptionPack base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SchedulingAgent base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: WIC base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x000003b4 key_handle: 0x000003bc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000007f4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW July 25, 2023, 7:34 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000007e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe" /F

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (2 events)

host	5.42.92.67
host	77.91.68.68

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService July 25, 2023, 7:26 a.m.	service_handle: 0x00000000022d6520 service_name: None control_code: 1		0	0
ControlService July 25, 2023, 7:26 a.m.	service_handle: 0x00000000022d6760 service_name: None control_code: 1		0	0

Installs itself for autorun at Windows startup (4 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\test22\AppData\Local\Temp\ebb444342c\legola.exe" /F

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Bitcoin\wallets
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Attempts to disable Windows Auto Updates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Collects information about installed applications (50 out of 54 events)

Time & API	Arguments	Status
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000003bc regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW July 25, 2023, 7:34 a.m.	key_handle: 0x000007e4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "legola.exe" /P "test22:N"&&CACLS "legola.exe" /P "test22:R" /E&&echo Y\|CACLS "..\ebb444342c" /P "test22:N"&&CACLS "..\ebb444342c" /P "test22:R" /E&&Exit
cmdline	cmd /k echo Y\|CACLS "legola.exe" /P "test22:N"&&CACLS "legola.exe" /P "test22:R" /E&&echo Y\|CACLS "..\ebb444342c" /P "test22:N"&&CACLS "..\ebb444342c" /P "test22:R" /E&&Exit
cmdline	CACLS "..\ebb444342c" /P "test22:N"
cmdline	CACLS "legola.exe" /P "test22:R" /E
cmdline	CACLS "legola.exe" /P "test22:N"
cmdline	CACLS "..\ebb444342c" /P "test22:R" /E

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 25, 2023, 7:34 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Disables Windows Security features (6 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection

lega.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All