Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 25, 2023, 6:36 p.m.	Sept. 25, 2023, 6:38 p.m.

Size	3.7MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`e9bbf60a02ceb5cbb6b712c1f0d18f2b`
SHA256	`7e950b8809c9c3b7fe396a0010c6ecf22a11d373f967cc070ba36bb579bd43ad`
CRC32	`9B54B7BD`
ssdeep	`98304:H5bDrvtPdYeJNadu8WC/6VKGX5UocCScpC8O3DE:nag9GocdDE`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques Generic_Malware_Zero - Generic Malware

saddsd.exe "C:\Users\test22\AppData\Local\Temp\saddsd.exe"
2564
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2792
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --remote-debugging-port=34569 --headless --user-data-dir="C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U" --profile-directory="Default"
    2912
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x90,0x94,0x98,0x8c,0x9c,0x7fef4eef1e8,0x7fef4eef1f8,0x7fef4eef208
      2964
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2916 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
      3032
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod= --annotation=ver= --initial-client-data=0x154,0x158,0x15c,0x150,0x160,0x7fef41d7218,0x7fef41d7228,0x7fef41d7238
      744

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 25, 2023, 6:36 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 6:36 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 6:29 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 6:29 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 6:29 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 6:29 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 6:29 p.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 6:29 p.m.			0	0

Command line console output was observed (50 out of 352 events)

Time & API	Arguments	Status	Return
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 5 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 5 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 3 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 2 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 2 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 9 and 007D46C8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 7 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 7 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 3 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 7 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 3 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 7 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 7 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 3 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 3 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 2 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 2 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 2 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 5 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 3 and 0074FCB8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 8 and 007D46C8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 5 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 5 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 5 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 7 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 9 and 007D46C8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 6 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 5 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 9 and 007D46C8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: b and 007D46C8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 9 and 007D46C8 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1
WriteConsoleA Sept. 25, 2023, 6:36 p.m.	buffer: 4 and 007D2888 console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 25, 2023, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00372250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00372250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 6:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00372190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 25, 2023, 6:36 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.BSS
section	.imports
section	.themida

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Sept. 25, 2023, 6:36 p.m.	stacktrace: saddsd+0x2cd271 @ 0x3fd271 saddsd+0x2e75d9 @ 0x4175d9 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 7666876 registers.edi: 2023424 registers.eax: 7666876 registers.ebp: 7666956 registers.edx: 2130566132 registers.ebx: 7667004 registers.esi: 1995994155 registers.ecx: 2121269248	1
__exception__ Sept. 25, 2023, 6:36 p.m.	stacktrace: exception.instruction_r: ed e9 bc b9 04 00 c3 e9 05 c9 02 00 0a 7a ec 60 exception.symbol: saddsd+0x2f4933 exception.instruction: in eax, dx exception.module: saddsd.exe exception.exception_code: 0xc0000096 exception.offset: 3098931 exception.address: 0x424933 registers.esp: 7666996 registers.edi: 8072608 registers.eax: 1750617430 registers.ebp: 2023424 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Sept. 25, 2023, 6:36 p.m.	stacktrace: exception.instruction_r: ed e9 20 c4 00 00 44 64 bd 9f ec 0a 00 00 00 d0 exception.symbol: saddsd+0x338712 exception.instruction: in eax, dx exception.module: saddsd.exe exception.exception_code: 0xc0000096 exception.offset: 3376914 exception.address: 0x468712 registers.esp: 7666996 registers.edi: 8072608 registers.eax: 1447909480 registers.ebp: 2023424 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Sept. 25, 2023, 6:36 p.m.	stacktrace: saddsd+0x85d4 @ 0x1385d4 saddsd+0x6363 @ 0x136363 saddsd+0x52ae @ 0x1352ae saddsd+0xa57c @ 0x13a57c 0x74fd7c exception.instruction_r: 8b 30 85 f6 0f 84 df 00 00 00 a1 10 70 16 00 8b exception.symbol: saddsd+0x164d3 exception.instruction: mov esi, dword ptr [eax] exception.module: saddsd.exe exception.exception_code: 0xc0000005 exception.offset: 91347 exception.address: 0x1464d3 registers.esp: 7666744 registers.edi: 0 registers.eax: 1751659577 registers.ebp: 7666764 registers.edx: 0 registers.ebx: 1474760 registers.esi: 12 registers.ecx: 1455284	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 106 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76faf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00165000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00158000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00158000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 61440 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00158000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ca0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02510000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7384b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b67000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b65000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7377a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00db6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dbc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00db9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (50 out of 65 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Favicons
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Current Session
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF3a15fe.TMP
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Shortcuts
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\History
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Local Storage\leveldb\000004.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Origin Bound Certs-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\History Provider Cache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Current Tabs
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\chrome_shutdown_ms.txt
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\History-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\CrashpadMetrics.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\previews_opt_out.db-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Favicons-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Safe Browsing Cookies-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Local Storage\leveldb\LOG.old
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Local Storage\leveldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Cookies-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\QuotaManager
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Safe Browsing Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Visited Links
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Web Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Safe Browsing Channel IDs
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\TransportSecurity
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Network Action Predictor-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Origin Bound Certs
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\CrashpadMetrics.pma~RF3a15fe.TMP
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Top Sites-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\previews_opt_out.db
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\QuotaManager-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Network Action Predictor
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Local Storage\leveldb\000003.ldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Local Storage\leveldb\LOCK
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Shortcuts-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Default\Local Storage\leveldb\LOG

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 25, 2023, 6:36 p.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00081a00', u'virtual_address': u'0x00039000', u'entropy': 7.945587417283362, u'name': u'.BSS', u'virtual_size': u'0x000818dc'}

entropy

7.94558741728

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 25, 2023, 6:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (3 events)

Time & API	Arguments	Status
NtTerminateProcess Sept. 25, 2023, 6:36 p.m.	status_code: 0x00000005 process_identifier: 2748 process_handle: 0x0000008c
NtTerminateProcess Sept. 25, 2023, 6:36 p.m.	status_code: 0x00000005 process_identifier: 2748 process_handle: 0x0000008c	1
NtTerminateProcess Sept. 25, 2023, 6:36 p.m.	status_code: 0xffffffff process_identifier: 2792 process_handle: 0x000005dc

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2748 region_size: 552960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000008c		3221225496	0
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 552960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000094	1	0	0

Checks for the presence of known windows from debuggers and forensic tools (33 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 6:36 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 25, 2023, 6:36 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

AppLaunch.exe tried to sleep 2728175 seconds, actually delayed analysis time by 2728175 seconds

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2564 manipulating memory of non-child process 2748
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2748 region_size: 552960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000008c		3221225496	0

Potential code injection by writing to the memory of another process (8 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL à.$æþ°@pY@ xPèØ`pà ¤.textäåæ`P`.dataýþê@`À.rdata¨è@0@.bss¤0À.idatax î@0À.CRT40ô@0À.tls@ö@0À.rsrcèPø@0À.relocp`þ@0B base_address: 0x00400000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: 395774651æ@@H@HHH 0HUnknown error_matherr(): %s in %s(%g, %g) (retval=%g) Argument domain error (DOMAIN)Argument singularity (SIGN)Overflow range error (OVERFLOW)The result is too small to be represented (UNDERFLOW)Total loss of significance (TLOSS)Partial loss of significance (PLOSS)dHH HÀHøHHMingw-w64 runtime failure: Address %p has no image-section VirtualQuery failed for %d bytes at address %p VirtualProtect failed with code 0x%x Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d. GCC: (GNU) 10.3.0GCC: (tdm64-1) 10.3.0GCC: (tdm64-1) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (tdm64-1) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (tdm64-1) 10.3.0 base_address: 0x00480000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: < ø#à x l$!!!¬!Ä!Ú!ê!ü!"0"N"V"d"t"""¦"²"Â"Ð"à"î"##"#,#8#@#J#R#\#d#n#v#####¨#²#!!¬!Ä!Ú!ê!ü!"0"N"V"d"t"""¦"²"Â"Ð"à"î"##"#,#8#@#J#R#\#d#n#v#####¨#²#÷CreateThreadDeleteCriticalSection6EnterCriticalSection GetCurrentProcessIdiGetLastErrorÙGetStartupInfoAmInitializeCriticalSectionÍLeaveCriticalSectionZSetUnhandledExceptionFilterjSleepTlsGetValue´VirtualAlloc½VirtualProtectÀVirtualQuery:__getmainargs;__initenvE__lconv_initM__p__acmdlnO__p__commodeT__p__fmodei__set_app_typel__setusermatherr_amsg_exit¢_cexita_initterme_iobu_onexit)abort2calloc>exitOfprintfVfreedfwritemallocmemcpy¸signalËstrlenÎstrncmpóvfprintf KERNEL32.dll msvcrt.dll base_address: 0x00482000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: 0@@ æ@æ@@æ@ base_address: 0x00483000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: base_address: 0x00484000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: 0HXP<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker"/> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!--The ID below indicates application support for Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!--The ID below indicates application support for Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!--The ID below indicates application support for Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!--The ID below indicates application support for Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!--The ID below indicates application support for Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> </assembly> base_address: 0x00485000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: 0 0*040>0J0P0Z0a0f0000ó041<1A1F1N1Z1a11¨1Ò1Û1ë1ù122D2J2R2Y2i2m2É2Ï2ç2í23f3p3v33333«3Ù3ø3 444-4E4^4t4{44²4Â4ù4pø?0E1°>:Ð±3à;àÀa5s55¦5»5Ç5è566"66¤6É6Î6C7[77û7:8G888½8â8 9%92999X9j9~99²9Ö9è9í9ò9:/:U:f:l:r::¢:¯:´:¼:Ç:Ó:ý:;A;G;b;h;u;{;;;¢;Ñ;æ;ô;U<¶<> >&>3>9>h>n>>µ>Ä>É>Ï>Ü>â>?#?)?.?c?i??¤?²?Î?ñ?ú?ð¬0#0-080>0c0i0 111'101;111¥1¯1Ã1Ï1×1å122%232>2Z2d2j2t2222Õ2ß2å2ó2ú233$3.3C3O3b3¦3µ3»3Å3Û3å3!4P4444¦4®4¶4¾4Æ4Î4Ö4Þ4æ4î4ö4þ45555&5.565I5Q5f555¡5Ô5 0ð`=\|=== 00000D1H1L1P1T1X10000 0$0 base_address: 0x00486000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2792 process_handle: 0x00000094	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL à.$æþ°@pY@ xPèØ`pà ¤.textäåæ`P`.dataýþê@`À.rdata¨è@0@.bss¤0À.idatax î@0À.CRT40ô@0À.tls@ö@0À.rsrcèPø@0À.relocp`þ@0B base_address: 0x00400000 process_identifier: 2792 process_handle: 0x00000094	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2564 called NtSetContextThread to modify thread in remote process 2792
NtSetContextThread Sept. 25, 2023, 6:36 p.m.	registers.eip: 1995571652 registers.esp: 3078876 registers.edi: 0 registers.eax: 4199600 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000098 process_identifier: 2792	1	0	0

One or more non-whitelisted processes were created (3 events)

parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x90,0x94,0x98,0x8c,0x9c,0x7fef4eef1e8,0x7fef4eef1f8,0x7fef4eef208
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2916 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod= --annotation=ver= --initial-client-data=0x154,0x158,0x15c,0x150,0x160,0x7fef41d7218,0x7fef41d7228,0x7fef41d7238

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2564 resumed a thread in remote process 2792
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000098 suspend_count: 1 process_identifier: 2792	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 25, 2023, 6:36 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 25, 2023, 6:36 p.m.	stacktrace: exception.instruction_r: ed e9 20 c4 00 00 44 64 bd 9f ec 0a 00 00 00 d0 exception.symbol: saddsd+0x338712 exception.instruction: in eax, dx exception.module: saddsd.exe exception.exception_code: 0xc0000096 exception.offset: 3376914 exception.address: 0x468712 registers.esp: 7666996 registers.edi: 8072608 registers.eax: 1447909480 registers.ebp: 2023424 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

Executed a process and injected code into it, probably while unpacking (39 events)

Time & API	Arguments	Status	Return
NtGetContextThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0xfffffffe	1	0
CreateProcessInternalW Sept. 25, 2023, 6:36 p.m.	thread_identifier: 2752 thread_handle: 0x0000002c process_identifier: 2748 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000008c	1	1
NtGetContextThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2748 region_size: 552960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000008c		3221225496
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: base_address: 0x00000000 process_identifier: 2748 process_handle: 0x0000008c		0
CreateProcessInternalW Sept. 25, 2023, 6:36 p.m.	thread_identifier: 2796 thread_handle: 0x00000098 process_identifier: 2792 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000094	1	1
NtGetContextThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000098	1	0
NtAllocateVirtualMemory Sept. 25, 2023, 6:36 p.m.	process_identifier: 2792 region_size: 552960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000094	1	0
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL à.$æþ°@pY@ xPèØ`pà ¤.textäåæ`P`.dataýþê@`À.rdata¨è@0@.bss¤0À.idatax î@0À.CRT40ô@0À.tls@ö@0À.rsrcèPø@0À.relocp`þ@0B base_address: 0x00400000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: base_address: 0x00401000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: base_address: 0x00410000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: 395774651æ@@H@HHH 0HUnknown error_matherr(): %s in %s(%g, %g) (retval=%g) Argument domain error (DOMAIN)Argument singularity (SIGN)Overflow range error (OVERFLOW)The result is too small to be represented (UNDERFLOW)Total loss of significance (TLOSS)Partial loss of significance (PLOSS)dHH HÀHøHHMingw-w64 runtime failure: Address %p has no image-section VirtualQuery failed for %d bytes at address %p VirtualProtect failed with code 0x%x Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d. GCC: (GNU) 10.3.0GCC: (tdm64-1) 10.3.0GCC: (tdm64-1) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (tdm64-1) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (GNU) 10.3.0GCC: (tdm64-1) 10.3.0 base_address: 0x00480000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: base_address: 0x00481000 process_identifier: 2792 process_handle: 0x00000094		0
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: < ø#à x l$!!!¬!Ä!Ú!ê!ü!"0"N"V"d"t"""¦"²"Â"Ð"à"î"##"#,#8#@#J#R#\#d#n#v#####¨#²#!!¬!Ä!Ú!ê!ü!"0"N"V"d"t"""¦"²"Â"Ð"à"î"##"#,#8#@#J#R#\#d#n#v#####¨#²#÷CreateThreadDeleteCriticalSection6EnterCriticalSection GetCurrentProcessIdiGetLastErrorÙGetStartupInfoAmInitializeCriticalSectionÍLeaveCriticalSectionZSetUnhandledExceptionFilterjSleepTlsGetValue´VirtualAlloc½VirtualProtectÀVirtualQuery:__getmainargs;__initenvE__lconv_initM__p__acmdlnO__p__commodeT__p__fmodei__set_app_typel__setusermatherr_amsg_exit¢_cexita_initterme_iobu_onexit)abort2calloc>exitOfprintfVfreedfwritemallocmemcpy¸signalËstrlenÎstrncmpóvfprintf KERNEL32.dll msvcrt.dll base_address: 0x00482000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: 0@@ æ@æ@@æ@ base_address: 0x00483000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: base_address: 0x00484000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: 0HXP<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker"/> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!--The ID below indicates application support for Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!--The ID below indicates application support for Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!--The ID below indicates application support for Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!--The ID below indicates application support for Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!--The ID below indicates application support for Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> </assembly> base_address: 0x00485000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: 0 0*040>0J0P0Z0a0f0000ó041<1A1F1N1Z1a11¨1Ò1Û1ë1ù122D2J2R2Y2i2m2É2Ï2ç2í23f3p3v33333«3Ù3ø3 444-4E4^4t4{44²4Â4ù4pø?0E1°>:Ð±3à;àÀa5s55¦5»5Ç5è566"66¤6É6Î6C7[77û7:8G888½8â8 9%92999X9j9~99²9Ö9è9í9ò9:/:U:f:l:r::¢:¯:´:¼:Ç:Ó:ý:;A;G;b;h;u;{;;;¢;Ñ;æ;ô;U<¶<> >&>3>9>h>n>>µ>Ä>É>Ï>Ü>â>?#?)?.?c?i??¤?²?Î?ñ?ú?ð¬0#0-080>0c0i0 111'101;111¥1¯1Ã1Ï1×1å122%232>2Z2d2j2t2222Õ2ß2å2ó2ú233$3.3C3O3b3¦3µ3»3Å3Û3å3!4P4444¦4®4¶4¾4Æ4Î4Ö4Þ4æ4î4ö4þ45555&5.565I5Q5f555¡5Ô5 0ð`=\|=== 00000D1H1L1P1T1X10000 0$0 base_address: 0x00486000 process_identifier: 2792 process_handle: 0x00000094	1	1
WriteProcessMemory Sept. 25, 2023, 6:36 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2792 process_handle: 0x00000094	1	1
NtSetContextThread Sept. 25, 2023, 6:36 p.m.	registers.eip: 1995571652 registers.esp: 3078876 registers.edi: 0 registers.eax: 4199600 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000098 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000098 suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x000001c4 suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 2792	1	0
CreateProcessInternalW Sept. 25, 2023, 6:36 p.m.	thread_identifier: 2916 thread_handle: 0x00000354 process_identifier: 2912 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --remote-debugging-port=34569 --headless --user-data-dir="C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U" --profile-directory="Default" filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000035c	1	1
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x000004dc suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x000004f0 suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x000004fc suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000540 suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x00000554 suspend_count: 1 process_identifier: 2792	1	0
NtResumeThread Sept. 25, 2023, 6:36 p.m.	thread_handle: 0x000005d4 suspend_count: 1 process_identifier: 2792	1	0
CreateProcessInternalW Sept. 25, 2023, 6:29 p.m.	thread_identifier: 2968 thread_handle: 0x00000000000000a0 process_identifier: 2964 current_directory: filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data8ME3U" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x90,0x94,0x98,0x8c,0x9c,0x7fef4eef1e8,0x7fef4eef1f8,0x7fef4eef208 filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000000000000a4	1	1
CreateProcessInternalW Sept. 25, 2023, 6:29 p.m.	thread_identifier: 3036 thread_handle: 0x0000000000000140 process_identifier: 3032 current_directory: filepath: track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2916 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6 filepath_r: stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000144	1	1
CreateProcessInternalW Sept. 25, 2023, 6:29 p.m.	thread_identifier: 1216 thread_handle: 0x0000000000000164 process_identifier: 744 current_directory: filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod= --annotation=ver= --initial-client-data=0x154,0x158,0x15c,0x150,0x160,0x7fef41d7218,0x7fef41d7228,0x7fef41d7238 filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000168	1	1
NtResumeThread Sept. 25, 2023, 6:29 p.m.	thread_handle: 0x00000000000001ec suspend_count: 1 process_identifier: 2912	1	0
NtResumeThread Sept. 25, 2023, 6:29 p.m.	thread_handle: 0x00000000000000e8 suspend_count: 1 process_identifier: 2964	1	0
NtResumeThread Sept. 25, 2023, 6:29 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 744	1	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.102956
ALYac	Trojan.GenericKDZ.102956
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
Cybereason	malicious.f4ae4d
VirIT	Trojan.Win32.GenusT.DRNM
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Packed.Themida.IIM
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Stealerc-10008534-0
Kaspersky	Trojan.Win32.HTA.wv
BitDefender	Trojan.GenericKDZ.102956
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:MalwareX-gen [Trj]
Sophos	Generic ML PUA (PUA)
F-Secure	Trojan.TR/AD.Nekark.zopdt
DrWeb	Trojan.Inject4.61167
VIPRE	Trojan.GenericKDZ.102956
McAfee-GW-Edition	BehavesLike.Win32.Generic.wh
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.e9bbf60a02ceb5cb
Emsisoft	Trojan.GenericKDZ.102956 (B)
Ikarus	Trojan.Win32.Injector
GData	Trojan.GenericKDZ.102956
Avira	TR/AD.Nekark.zopdt
Gridinsoft	Trojan.Heur!.030100A1
Arcabit	Trojan.Generic.D1922C
ZoneAlarm	Trojan.Win32.HTA.wv
Microsoft	Trojan:Win32/Stealerc.GMF!MTB
Google	Detected
McAfee	Artemis!E9BBF60A02CE
MAX	malware (ai score=86)
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Trojan.MalPack
Zoner	Probably Heur.ExeHeaderL
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZexaF.36722.QFW@aOvpkwc
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

saddsd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All