Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 31, 2023, 9:39 a.m.	Aug. 31, 2023, 9:41 a.m.

Size	1.7MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9ddf58d42ea6fd8cbc1f2642c336358f`
SHA256	`585c6f4a346365aeaf83f0f72be43074b98a360e4458c8b1e81f55ce55d1067c`
CRC32	`E6433621`
ssdeep	`24576:Rzt7tEeCatVDWRfVv987SgPTLzIwRkDDQdEUCFTMTxcLQH:JNtE3OTLEh/Qd4SOQ`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

taskhost.exe "C:\Users\test22\AppData\Local\Temp\taskhost.exe"
316
- InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2240
  - winlog.exe "C:\Users\test22\AppData\Local\Temp\winlog.exe"
    2872
  - msedge.exe "C:\Users\test22\AppData\Local\Temp\msedge.exe"
    2968

Name	Response	Post-Analysis Lookup
rc30.tuktuk.ug	A 85.209.3.9	85.209.3.9

IP Address	Status	Action
164.124.101.2	Active	Moloch
85.209.3.9	Active	Moloch
95.214.27.254	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043233	ET INFO Microsoft net.tcp Connection Initialization Activity	Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2046045	ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	A Network Trojan was detected
TCP 85.209.3.9:11290 -> 192.168.56.103:49164	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49166 -> 95.214.27.254:80	2017679	ET HUNTING SUSPICIOUS winlog.exe in URI Probable Process Dump/Trojan Download	A Network Trojan was detected
TCP 192.168.56.103:49166 -> 95.214.27.254:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 95.214.27.254:80 -> 192.168.56.103:49166	2014819	ET INFO Packed Executable Download	Misc activity
TCP 95.214.27.254:80 -> 192.168.56.103:49166	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 95.214.27.254:80 -> 192.168.56.103:49166	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 95.214.27.254:80 -> 192.168.56.103:49166	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 95.214.27.254:80 -> 192.168.56.103:49166	2014819	ET INFO Packed Executable Download	Misc activity
TCP 192.168.56.103:49166 -> 95.214.27.254:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 85.209.3.9:11290	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 31, 2023, 9:40 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 31, 2023, 9:39 a.m.			0	0
IsDebuggerPresent Aug. 31, 2023, 9:39 a.m.			0	0
IsDebuggerPresent Aug. 31, 2023, 9:39 a.m.			0	0
IsDebuggerPresent Aug. 31, 2023, 9:39 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (17 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007996d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007996d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007996d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007996d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00799758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00799758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00799658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00799658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00799658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00799658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00799658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007996d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007996d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007998d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079a018 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0079a018 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 31, 2023, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00799d18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 31, 2023, 9:39 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more processes crashed (15 events)

Time & API	Arguments	Status
__exception__ Aug. 31, 2023, 9:39 a.m.	stacktrace: 0xa085f1 0xa0850a 0xa08440 0xa083c0 0xa08303 0xa082a7 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x74080f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f4bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f32ae9 0xa07f6b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x74080f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f4bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f32ae9 0xa07f17 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x73fb564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x73f8be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x73f8b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x73f8b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x73f8bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x73f8bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x73f4cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x73f4cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x74038841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x73fb14e9 mscorlib+0x2d36ad @ 0x728936ad mscorlib+0x308f2d @ 0x728c8f2d 0xa07e59 0xa0763b 0xa07606 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x73f570df LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x73fa412e mscorlib+0x2f1c22 @ 0x728b1c22 mscorlib+0x2f1b99 @ 0x728b1b99 mscorlib+0x2f0814 @ 0x728b0814 mscorlib+0x307407 @ 0x728c7407 0xa07585 0xa0008a DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73ff74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73ff7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74081dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74081e67 exception.instruction_r: 83 78 04 00 0f 85 4b 2b 00 00 c7 85 dc fd ff ff exception.instruction: cmp dword ptr [eax + 4], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa09804 registers.esp: 5687524 registers.edi: 5688964 registers.eax: 0 registers.ebp: 5688976 registers.edx: 0 registers.ebx: 5689360 registers.esi: 3372 registers.ecx: 33456224	1
__exception__ Aug. 31, 2023, 9:39 a.m.	stacktrace: 0x50d329 0x50d12b 0x507ad8 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x50d460 registers.esp: 2419540 registers.edi: 2419592 registers.eax: 0 registers.ebp: 2419604 registers.edx: 7872688 registers.ebx: 2421044 registers.esi: 38686764 registers.ecx: 0	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0xa29ada4 0xa29a63a 0xa29a50d 0xa299370 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417796 registers.edi: 2418140 registers.eax: 0 registers.ebp: 2417804 registers.edx: 0 registers.ebx: 2421044 registers.esi: 41020112 registers.ecx: 42661256	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0xa29ada4 0xa29a63a 0xa29a525 0xa299370 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417796 registers.edi: 2418140 registers.eax: 0 registers.ebp: 2417804 registers.edx: 0 registers.ebx: 2421044 registers.esi: 41020112 registers.ecx: 43965648	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0xa29ada4 0xa29a63a 0xa29a525 0xa299370 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417796 registers.edi: 2418140 registers.eax: 0 registers.ebp: 2417804 registers.edx: 0 registers.ebx: 2421044 registers.esi: 41020112 registers.ecx: 40571496	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0xa29fd96 0xa29f651 0xa29a50d 0xa299bbf 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417772 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417780 registers.edx: 0 registers.ebx: 2421044 registers.esi: 39202256 registers.ecx: 41982576	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0xa29fd96 0xa29f651 0xa29a525 0xa299bbf 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417772 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417780 registers.edx: 0 registers.ebx: 2421044 registers.esi: 39202256 registers.ecx: 43329328	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0xa29fd96 0xa29f651 0xa29a525 0xa299bbf 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417772 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417780 registers.edx: 0 registers.ebx: 2421044 registers.esi: 39202256 registers.ecx: 44924576	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0x6f1070a 0x6f100b1 0xa29a50d 0xa299cda 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417824 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417832 registers.edx: 0 registers.ebx: 2421044 registers.esi: 39202256 registers.ecx: 38450928	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0x6f1070a 0x6f100b1 0xa29a525 0xa299cda 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417824 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417832 registers.edx: 0 registers.ebx: 2421044 registers.esi: 38367640 registers.ecx: 38446716	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0x6f1070a 0x6f100b1 0xa29a525 0xa299cda 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417824 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417832 registers.edx: 0 registers.ebx: 2421044 registers.esi: 38367640 registers.ecx: 40177088	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0x6f10e1c 0x6f10879 0xa29a50d 0xa299de0 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417856 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417864 registers.edx: 0 registers.ebx: 2421044 registers.esi: 38367640 registers.ecx: 41570872	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0x6f10e1c 0x6f10879 0xa29a525 0xa299de0 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417856 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417864 registers.edx: 0 registers.ebx: 2421044 registers.esi: 38367640 registers.ecx: 39336416	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0x6f10e1c 0x6f10879 0xa29a525 0xa299de0 0xa2983d8 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2417856 registers.edi: 2418164 registers.eax: 0 registers.ebp: 2417864 registers.edx: 0 registers.ebx: 2421044 registers.esi: 38367640 registers.ecx: 40732688	1
__exception__ Aug. 31, 2023, 9:40 a.m.	stacktrace: 0xa29ec98 0x6f121a3 0x6f1174e 0xa298430 0x50d9ff 0x507c1d 0x5072d3 0x503c6b 0x5035d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73eb2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73ec264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73ec2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f774ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f77610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74001dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74001e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74001f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7400416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7455f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa29ecdb registers.esp: 2418948 registers.edi: 2419212 registers.eax: 0 registers.ebp: 2418956 registers.edx: 0 registers.ebx: 2421044 registers.esi: 41301596 registers.ecx: 41308572	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://95.214.27.254/getfile/winlog.exe
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://95.214.27.254/getfile/msedge.exe

Performs some HTTP requests (2 events)

request	GET http://95.214.27.254/getfile/winlog.exe
request	GET http://95.214.27.254/getfile/msedge.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 119 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02090000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00705000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0070b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00707000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02020000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f9e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0204f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04aca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 316 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04acb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73eb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73eb2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02170000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00501000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00502000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\winlog.exe
file	C:\Users\test22\AppData\Local\Temp\msedge.exe

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\winlog.exe
file	C:\Users\test22\AppData\Local\Temp\msedge.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 31, 2023, 9:40 a.m.	flags: 15 family: 0		111	0

An executable file was downloaded by the process installutil.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
recv Aug. 31, 2023, 9:40 a.m.	buffer: HTTP/1.1 200 OK Server: nginx/1.17.10 (Ubuntu) Date: Thu, 31 Aug 2023 00:40:25 GMT Content-Type: application/octet-stream Content-Length: 13320192 Last-Modified: Wed, 30 Aug 2023 18:08:02 GMT Connection: keep-alive ETag: "64ef8582-cb4000" Accept-Ranges: bytes MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEdð.$Ð=<Ë¾À@pÒÏË` àÐðÐ\|#@ÑèpÉH`PÑ4@ZÉ(4øÐ¨.textÐÏ=Ð=```.data0Zà=\Ô=@`À.rdataÀ.@B00B@`@.pdataH`pÉb`É@0@.xdata¸9àÉ:ÂÉ@0@.bssÀ¼ Ê`À.edataàÐüÉ@0@.idata\|#ðÐ$Ê@0À.CRTp Ñ$Ê@@À.tls0Ñ&Ê@@À.rsrcè@Ñ(Ê@0À.reloc4PÑ.Ê@0BÃff.@Hì(HeRÉ1ÉÇHfRÉÇHiRÉÇH,RÉÇHoOÉf8MZuHcP<HÐ8PEtiHòQÉ ¬ÊÀtF¹èÅ=è'Ì=HpQÉèÌ=H@QÉèw=H NÉ8tS1ÀHÄ(Ã@¹èVÅ=ë¸@·PfútEfúu¸xÿÿÿø1ÉÒÁéfÿÿÿH ñ=è¬=1ÀHÄ(ÃDxt=ÿÿÿDè1ÉEÀÁé)ÿÿÿfHì8HQÉLÖÊH×ÊH ØÊ°ÊH©ÊHD$ HuPÉDèÄ=HÄ8ÃAUATUWVSHì¹ 1ÀLD$ LÇóH«H=¨PÉDEÉeH%0HLNÉHp1íL%éÐëDH9Æ¹èAÿÔHèðH±3HÀuâH5#NÉ1íøÀlÇî ÊøûíHXMÉHHÀtE1Àº1ÉÿÐè=H h=ÿnèÐHMÉH ýÿÿHè,É=èw=H0MÉHy ÊèôÉ=1ÉHHÀuëXÒtEát'¹HÀ¶ú ~æAÈAðú"ADÈëäfDÒt@¶PHÀÒtú ~ïH ÊDEÀt¸ öD$\àâÌ=Hc- ÊDeMcäIÁäLáèÂ=L-ñÊHÇí~B1ÛILÝèÁ=HpHñèÒÁ=IðHßITÝHÁHÃè²Á=H9ÝuÍJD'øHÇH=ÊèU=H.LÉLÊ ÊHLHtÊèß YÊWÊÉÙAÊÒHÄ[^_]A\A]ÃD·D$`éÿÿÿfDH5!LÉ½øûýÿÿ¹èçÁ=øþÿÿHELÉH .LÉèÁ=Çíìýÿÿ1ÀHéâýÿÿLÁÿ;åÐéVýÿÿfèÁ=©ÊHÄ[^_]A\A]ÃDH LÉH òKÉÇè7Á=éýÿÿÁèãÀ=f.Hì(HMÉÇèºüÿÿHÄ(ÃHì(HuMÉÇèüÿÿHÄ(ÃHì(èÇÀ=HÀÀ¶À÷ØHÄ(ÃH éÔÿÿÿ@ÃI;fv8HìHl$Hl$HD$ H\$(fèÛHD$ H\$(è,Hl$HÄÃHD$H\$èóHD$H\$ë§ÌÌÌÌÌÌÌLd$øM;f-HìH¬$H¬$H$ëHøHóHÛHD$hH\$0¹,è HÀ}HT$h1ö1ÿHD$0ë$HT$0H)ÂHÿÊHÖH÷ÚHÁú?HxH!×HT$hH×Hø\|:cpu.uHt$PH\|$xHD$0HÃ¹=HÐè§ received: 2920 socket: 1096	1	2920	0
recv Aug. 31, 2023, 9:40 a.m.	buffer: HTTP/1.1 200 OK Server: nginx/1.17.10 (Ubuntu) Date: Thu, 31 Aug 2023 00:40:32 GMT Content-Type: application/octet-stream Content-Length: 21412864 Last-Modified: Wed, 30 Aug 2023 18:08:46 GMT Connection: keep-alive ETag: "64ef85ae-146bc00" Accept-Ranges: bytes MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEdð.$Ð=¸F¾À@ðM=CG` `LpL\|#ÀLèðDH`ÐL$ÖD(4xL¨.text0Ï=Ð=```.data0Zà=\Ô=@`À.rdataª@B¬0B@`@.pdataH`ðDbÜD@0@.xdata¸9`E:>E@0@.bssÀ¼ E`À.edata`LxE@0@.idata\|#pL$\|E@0À.CRTp L E@@À.tls°L¢E@@À.rsrcèÀL¤E@0À.reloc$ÐLªE@0BÃff.@Hì(H%ÎD1ÉÇH&ÎDÇH)ÎDÇHìÍDÇH/ËDf8MZuHcP<HÐ8PEtiH²ÍD ¬EÀtF¹èüÄ=èË=H0ÍDègË=HÍDè×=H`ÊD8tS1ÀHÄ(Ã@¹è¶Ä=ë¸@·PfútEfúu¸xÿÿÿø1ÉÒÁéfÿÿÿH Q=è=1ÀHÄ(ÃDxt=ÿÿÿDè1ÉEÀÁé)ÿÿÿfHì8HÅÌDLÖEH×EH ØE°EH©EHD$ H5ÌDDè Ä=HÄ8ÃAUATUWVSHì¹ 1ÀLD$ LÇóH«H=hÌDDEÉeH%0HÊDHp1íL%iLëDH9Æ¹èAÿÔHèðH±3HÀuâH5ãÉD1íøÀlÇîEøûíHÉDHHÀtE1Àº1ÉÿÐèï=H È=ÿnhLH[ÉDH ýÿÿHèÈ=è×=HðÈDHyEèTÉ=1ÉHHÀuëXÒtEát'¹HÀ¶ú ~æAÈAðú"ADÈëäfDÒt@¶PHÀÒtú ~ïHEDEÀt¸ öD$\àâÌ=Hc-EDeMcäIÁäLáè`Á=L-ñEHÇí~B1ÛILÝèîÀ=HpHñè2Á=IðHßITÝHÁHÃèÁ=H9ÝuÍJD'øHÇH=Eèµ=HîÇDLE EHLHtEèß YEWEÉÙAEÒHÄ[^_]A\A]ÃD·D$`éÿÿÿfDH5áÇD½øûýÿÿ¹èGÁ=øþÿÿHÈDH îÇDèùÀ=Çíìýÿÿ1ÀHéâýÿÿLÁÿ;eLéVýÿÿfèãÀ=©EHÄ[^_]A\A]ÃDHÉÇDH ²ÇDÇèÀ=éýÿÿÁèCÀ=f.Hì(HUÉDÇèºüÿÿHÄ(ÃHì(H5ÉDÇèüÿÿHÄ(ÃHì(è'À=HÀÀ¶À÷ØHÄ(ÃH éÔÿÿÿ@ÃI;fv8HìHl$Hl$HD$ H\$(fèÛHD$ H\$(è,Hl$HÄÃHD$H\$èóHD$H\$ë§ÌÌÌÌÌÌÌLd$øM;f-HìH¬$H¬$H$ëHøHóHÛHD$hH\$0¹,è HÀ}HT$h1ö1ÿHD$0ë$HT$0H)ÂHÿÊHÖH÷ÚHÁú?HxH!×HT$hH×Hø\|:cpu.uHt$PH\|$xHD$0HÃ¹=HÐè§ received: 2920 socket: 1096	1	2920	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 31, 2023, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 31, 2023, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 51 events)

Time & API	Arguments	Status
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000035c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: 7-Zip base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: AddressBook base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: Adobe AIR base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: Connection Manager base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: DirectDrawEx base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: EditPlus base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: Fontcore base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: Google Chrome base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: IE40 base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: IE4Data base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: IE5BAKEX base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: IEData base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: MobileOptionPack base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: Office15.PROPLUSR base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: SchedulingAgent base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: WIC base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW Aug. 31, 2023, 9:39 a.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x0000035c key_handle: 0x00000360 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: ea121214f0c1e113d5c5195cc03bc9940bb30337
buffer	Buffer with sha1: 5e0e915132dc0c38da7192acc445dcf1ded199e3

Communicates with host for which no DNS query was performed (1 event)

host

95.214.27.254

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 196608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	1	0	0

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELkûà0þ5 @@ @¬5O@Nà H.text `.rsrcN@@@.relocà¶@B base_address: 0x00400000 process_identifier: 2240 process_handle: 0x00000244	1	1
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: 06 base_address: 0x0042e000 process_identifier: 2240 process_handle: 0x00000244	1	1
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2240 process_handle: 0x00000244	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELkûà0þ5 @@ @¬5O@Nà H.text `.rsrcN@@@.relocà¶@B base_address: 0x00400000 process_identifier: 2240 process_handle: 0x00000244	1	1	0

Collects information about installed applications (38 events)

Time & API	Arguments	Status
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Aug. 31, 2023, 9:39 a.m.	key_handle: 0x00000360 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

FireEye	Generic.mg.9ddf58d42ea6fd8c
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.36662.Pr0@ams03Pn
APEX	Malicious
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft	Malware.Win32.RedLine.bot
ZoneAlarm	UDS:Trojan-Spy.MSIL.Stealer.gen
VBA32	Trojan.MSIL.Bitrans.Heur
Ikarus	Trojan.Blocker
MaxSecure	Trojan.Malware.300983.susgen

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 316 called NtSetContextThread to modify thread in remote process 2240
NtSetContextThread Aug. 31, 2023, 9:39 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4339198 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2240	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 316 resumed a thread in remote process 2240
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2240	1	0	0

Executed a process and injected code into it, probably while unpacking (29 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 316	1	0
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 316	1	0
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 316	1	0
CreateProcessInternalW Aug. 31, 2023, 9:39 a.m.	thread_identifier: 2244 thread_handle: 0x0000023c process_identifier: 2240 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000244	1	1
NtGetContextThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x0000023c	1	0
NtAllocateVirtualMemory Aug. 31, 2023, 9:39 a.m.	process_identifier: 2240 region_size: 196608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	1	0
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELkûà0þ5 @@ @¬5O@Nà H.text `.rsrcN@@@.relocà¶@B base_address: 0x00400000 process_identifier: 2240 process_handle: 0x00000244	1	1
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: base_address: 0x00402000 process_identifier: 2240 process_handle: 0x00000244	1	1
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: base_address: 0x00424000 process_identifier: 2240 process_handle: 0x00000244	1	1
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: 06 base_address: 0x0042e000 process_identifier: 2240 process_handle: 0x00000244	1	1
WriteProcessMemory Aug. 31, 2023, 9:39 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2240 process_handle: 0x00000244	1	1
NtSetContextThread Aug. 31, 2023, 9:39 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4339198 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2240	1	0
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x000001c8 suspend_count: 1 process_identifier: 2240	1	0
NtGetContextThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Aug. 31, 2023, 9:39 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Aug. 31, 2023, 9:40 a.m.	thread_handle: 0x0000042c suspend_count: 1 process_identifier: 2240	1	0
NtResumeThread Aug. 31, 2023, 9:40 a.m.	thread_handle: 0x0000024c suspend_count: 1 process_identifier: 2240	1	0
CreateProcessInternalW Aug. 31, 2023, 9:40 a.m.	thread_identifier: 2876 thread_handle: 0x0000057c process_identifier: 2872 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\winlog.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\winlog.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\winlog.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000584	1	1
NtResumeThread Aug. 31, 2023, 9:40 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2240	1	0
CreateProcessInternalW Aug. 31, 2023, 9:40 a.m.	thread_identifier: 2972 thread_handle: 0x0000052c process_identifier: 2968 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\msedge.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\msedge.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\msedge.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000058c	1	1
NtResumeThread Aug. 31, 2023, 9:33 a.m.	thread_handle: 0x00000000000000c0 suspend_count: 1 process_identifier: 2872	1	0
NtResumeThread Aug. 31, 2023, 9:33 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2872	1	0
NtResumeThread Aug. 31, 2023, 9:33 a.m.	thread_handle: 0x00000000000000c0 suspend_count: 1 process_identifier: 2968	1	0
NtResumeThread Aug. 31, 2023, 9:33 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2968	1	0

taskhost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All