Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 10, 2023, 9:26 a.m.	Nov. 10, 2023, 9:28 a.m.

Size	511.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`2c1702ec1ce5fce93e682e82afe6fd91`
SHA256	`974c305c041b850912060ae637ec1fc4a89c83286ebe2535df60036e02556627`
CRC32	`560F3DC2`
ssdeep	`12288:wMrhy90SyZFroFxDFehD9iSY8TUs2vue+4+wSRnFds8aYni3z:ByDKJ6FehDMSYSz2vu5US5Loz`
PDB Path	wextract.pdb
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file UPX_Zero - UPX packed file

from.exe "C:\Users\test22\AppData\Local\Temp\from.exe"
2560
- Gi9lq59.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Gi9lq59.exe
  2612
  - 3FW601gq.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\3FW601gq.exe
    2692
    - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2764
  - 4dL7fs8.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\4dL7fs8.exe
    2836
    - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2960
- 5xW39Af.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\5xW39Af.exe
  3020
  - cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\is64.bat" "
    940

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
193.233.255.73	Active	Moloch
5.42.92.51	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043233	ET INFO Microsoft net.tcp Connection Initialization Activity	Potentially Bad Traffic
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2046045	ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	A Network Trojan was detected
TCP 5.42.92.51:19057 -> 192.168.56.101:49177	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49177 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49168 -> 193.233.255.73:80	2047625	ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST)	A Network Trojan was detected
TCP 192.168.56.101:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 10, 2023, 9:26 a.m.			0	0
IsDebuggerPresent Nov. 10, 2023, 9:26 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (17 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2d80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004f2f00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00564388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00564388 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00564248 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 10, 2023, 9:26 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (50 out of 71211 events)

Time & API	Arguments	Status
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 5 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1937075299 registers.ebx: 0 registers.esi: 6955808 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 4 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1970365249 registers.ebx: 0 registers.esi: 6955812 registers.ecx: 3684720849	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1399157353 registers.ebx: 0 registers.esi: 6955816 registers.ecx: 1280335481	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1867274066 registers.ebx: 0 registers.esi: 6955820 registers.ecx: 4121499506	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 2017815395 registers.ebx: 0 registers.esi: 6955824 registers.ecx: 719449619	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 5 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1684370017 registers.ebx: 0 registers.esi: 6955808 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 4 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1970365249 registers.ebx: 0 registers.esi: 6955812 registers.ecx: 3684720849	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1399157353 registers.ebx: 0 registers.esi: 6955816 registers.ecx: 1280335481	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1867274066 registers.ebx: 0 registers.esi: 6955820 registers.ecx: 4121499506	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1750297443 registers.ebx: 0 registers.esi: 6955824 registers.ecx: 3771723283	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1131701057 registers.ebx: 0 registers.esi: 3799756 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1769235265 registers.ebx: 0 registers.esi: 3799760 registers.ecx: 3428016337	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1702125942 registers.ebx: 0 registers.esi: 3799764 registers.ecx: 3874855382	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1097690996 registers.ebx: 0 registers.esi: 3799756 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1097098305 registers.ebx: 0 registers.esi: 3799760 registers.ecx: 1563226577	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1466789748 registers.ebx: 0 registers.esi: 3799756 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1097098305 registers.ebx: 0 registers.esi: 3799760 registers.ecx: 1563226577	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 4 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1098080617 registers.ebx: 0 registers.esi: 6955808 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1130652737 registers.ebx: 0 registers.esi: 6955812 registers.ecx: 2133651921	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1869835887 registers.ebx: 0 registers.esi: 6955816 registers.ecx: 3447952351	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1816225132 registers.ebx: 0 registers.esi: 6955820 registers.ecx: 126205484	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 4 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1467179369 registers.ebx: 0 registers.esi: 6955808 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1130652737 registers.ebx: 0 registers.esi: 6955812 registers.ecx: 2133651921	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1869835887 registers.ebx: 0 registers.esi: 6955816 registers.ecx: 3447952351	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1816225132 registers.ebx: 0 registers.esi: 6955820 registers.ecx: 126205484	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 9 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1869901929 registers.ebx: 0 registers.esi: 6963696 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 8 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1231316033 registers.ebx: 0 registers.esi: 6963700 registers.ecx: 3844927953	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 7 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1734702190 registers.ebx: 0 registers.esi: 6963704 registers.ecx: 255660110	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 6 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 2037672306 registers.ebx: 0 registers.esi: 6963708 registers.ecx: 1526365074	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 5 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1700946252 registers.ebx: 0 registers.esi: 6963712 registers.ecx: 1783842828	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 4 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1114592364 registers.ebx: 0 registers.esi: 6963716 registers.ecx: 1158749484	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1684960623 registers.ebx: 0 registers.esi: 6963720 registers.ecx: 3222375135	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1148809825 registers.ebx: 0 registers.esi: 6963724 registers.ecx: 773132785	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1919120229 registers.ebx: 0 registers.esi: 6963728 registers.ecx: 1792035125	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 7 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1835093618 registers.ebx: 0 registers.esi: 6955808 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 6 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1281647681 registers.ebx: 0 registers.esi: 6955812 registers.ecx: 2553082321	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 5 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1818321775 registers.ebx: 0 registers.esi: 6955816 registers.ecx: 2840090847	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 4 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1702128705 registers.ebx: 0 registers.esi: 6955820 registers.ecx: 3918100945	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1952542322 registers.ebx: 0 registers.esi: 6955824 registers.ecx: 1237799058	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1836008293 registers.ebx: 0 registers.esi: 6955828 registers.ecx: 751900981	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1702131056 registers.ebx: 0 registers.esi: 6955832 registers.ecx: 642348144	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 7 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1835093618 registers.ebx: 0 registers.esi: 6955808 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 6 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1281647681 registers.ebx: 0 registers.esi: 6955812 registers.ecx: 2553082321	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 5 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1818321775 registers.ebx: 0 registers.esi: 6955816 registers.ecx: 2840090847	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 4 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1702128705 registers.ebx: 0 registers.esi: 6955820 registers.ecx: 3918100945	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1952542322 registers.ebx: 0 registers.esi: 6955824 registers.ecx: 1237799058	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1836008293 registers.ebx: 0 registers.esi: 6955828 registers.ecx: 751900981	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 1 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1702131056 registers.ebx: 0 registers.esi: 6955832 registers.ecx: 642348144	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 3 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 2020885364 registers.ebx: 0 registers.esi: 3799756 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x7598c19d _GetSpecialResolution@0-0xf6 3fw601gq+0x17e0 @ 0x8217e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x76f52c36 registers.esp: 3799612 registers.edi: 2 registers.eax: 3799656 registers.ebp: 3799672 registers.edx: 1382310977 registers.ebx: 0 registers.esi: 3799760 registers.ecx: 4264358353	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://193.233.255.73/loghub/master

Performs some HTTP requests (1 event)

request

POST http://193.233.255.73/loghub/master

Sends data using the HTTP POST Method (1 event)

request

POST http://193.233.255.73/loghub/master

Allocates read-write-execute memory (usually to unpack itself) (50 out of 104 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73261000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00930000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7152a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00745000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00747000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00737000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73741000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcdf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f8f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d46e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d2eb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00736000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 3252609 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 3252609 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 3252492 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 3252492 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (7 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\lockfile
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\is64.bat
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\4dL7fs8.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Gi9lq59.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\5xW39Af.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\3FW601gq.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\is64.bat

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 10, 2023, 9:26 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\is64.bat parameters: filepath: C:\Users\test22\AppData\Local\Temp\is64.bat	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00077600', u'virtual_address': u'0x0000c000', u'entropy': 7.87442779235381, u'name': u'.rsrc', u'virtual_size': u'0x00078000'}

entropy

7.87442779235

description

A section with a high entropy has been found

entropy

0.936274509804

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 10, 2023, 9:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (28 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000540 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: AddressBook base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Connection Manager base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: EditPlus base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: ENTERPRISE base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Fontcore base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Google Chrome base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: IE40 base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: IE4Data base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: IEData base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: WIC base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x00000540 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (2 events)

host	193.233.255.73
host	5.42.92.51

Creates an Alternate Data Stream (ADS) (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\echo:1

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2764 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000011c	1	0	0
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000011c	1	0	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0				reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1				reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Potential code injection by writing to the memory of another process (7 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÎ7Meà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þZB@¶B@¶B@¶B@¶B@¶BH¶B]B^BÈTBµB`°BC¶B(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB¶B,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB..þÿÿÿ þÿÿÿuLÓôk§cßÜÆí&XÔi¾üørÕ ²l¢-µsõ^}xFÝz§ÁÆ¯µ{*C]}u¸ØwÉÇiíÖ(õ[!¼h¬=Ð)ÄI\íAÙU$þ6fyôKÈ\|`@óém0Ø8v¶¤.~%âïÇ¨ÎÝ$}DÜHYØÃWæ\ÃsS?½ïGmhO3Jê¹§)ûäa/§tR¡AºÕÿê4ÿÿ° Kñ9ãÉD}E/BçGüÜgnÅÚ9ô3/çÀ4è± ßKÎóÎ3¸õxÏ´sÜz¸ãî¨7iÓUØ¶ÔHuç¢:J4Ðar0YÆA¾¼O1lKz²E½±íZJ2`Aà5²ÆÅz±0}K!tÌwþl¢T`Dñ(4UÕæ!Fæ@ÜDÔ&ÿ®\|iª¡ý-Vôü>ê;ÂxkßÀ#3J$UnT¸?µÝòg\ç4&Ú3\|Fuw¤e«ãè £èn¢±>v5å.góFÃ\|,¡9UF~£ÇÖ¡.]PÓ0ÿoÚLåÂÆC°âæêÁ'=`SËJ¤øÒ´B\|×°'ëQ(÷«¹yl)2Ô;<÷Fýä@ÊZ%×ïÅÈÄ,Qñ´=Ï£¥£PöaS;qî.Øy´}R¤à1ÔwxS±¢ RðÈ/½î5~èÛSôÆ§S½ÜÁÙ`É5Utàô¶oý«õ`6¡âòí¦a:Æ¦m!Åcà}²{îa¯Mme®2@¾@£xbÈ^¥i>JÃå)¤±JõòÓÂ3²ÝÞo<BNPòÁbVlÎ_%Ïòrøß>Ûãù´s·äîu±ü¿c\£RôKêüM¡³¾n>÷D»5Öèõ\|9!! ÊrjH«·öã^4Ì»¢ûö©[{ ÁáâàÜxÅbýD^W·Ñà§ÃêAu»vÂiâ7ÎÕèç~¨±+¹±¼ôà~\| yì8Eõ¾¹?äµ÷¼F+>`V\|B.?AVbad_exception@std@@\|B.?AVexception@std@@\|B.?AVtype_info@@ base_address: 0x0042b000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: 0 H`à}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042e000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁ ²à0À¬Þ à@ À@@ÞKàN© H.text¾ À `.rsrcN©àªÂ@@.reloc l@B base_address: 0x00400000 process_identifier: 2960 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: Ð> base_address: 0x0043a000 process_identifier: 2960 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2960 process_handle: 0x0000011c	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÎ7Meà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2764 process_handle: 0x0000011c	1	1	0
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁ ²à0À¬Þ à@ À@@ÞKàN© H.text¾ À `.rsrcN©àªÂ@@.reloc l@B base_address: 0x00400000 process_identifier: 2960 process_handle: 0x0000011c	1	1	0

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x00000548 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2692 called NtSetContextThread to modify thread in remote process 2764
Process injection	Process 2836 called NtSetContextThread to modify thread in remote process 2960
NtSetContextThread Nov. 10, 2023, 9:26 a.m.	registers.eip: 1995571652 registers.esp: 2686564 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2764	1	0	0
NtSetContextThread Nov. 10, 2023, 9:26 a.m.	registers.eip: 1995571652 registers.esp: 2554404 registers.edi: 0 registers.eax: 4382350 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2960	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2692 resumed a thread in remote process 2764
Process injection	Process 2836 resumed a thread in remote process 2960
Process injection	Process 3020 resumed a thread in remote process 940
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2764	1	0	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2960	1	0	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 940	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.101:49173

Executed a process and injected code into it, probably while unpacking (50 out of 52 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2616 thread_handle: 0x0000001c process_identifier: 2612 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Gi9lq59.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000124	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 3024 thread_handle: 0x00000124 process_identifier: 3020 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\5xW39Af.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2696 thread_handle: 0x0000001c process_identifier: 2692 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\3FW601gq.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000124	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2840 thread_handle: 0x00000124 process_identifier: 2836 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\4dL7fs8.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2768 thread_handle: 0x0000002c process_identifier: 2764 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000011c	1	1
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2764 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000011c	1	0
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÎ7Meà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x00401000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x00424000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þZB@¶B@¶B@¶B@¶B@¶BH¶B]B^BÈTBµB`°BC¶B(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB¶B,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB..þÿÿÿ þÿÿÿuLÓôk§cßÜÆí&XÔi¾üørÕ ²l¢-µsõ^}xFÝz§ÁÆ¯µ{*C]}u¸ØwÉÇiíÖ(õ[!¼h¬=Ð)ÄI\íAÙU$þ6fyôKÈ\|`@óém0Ø8v¶¤.~%âïÇ¨ÎÝ$}DÜHYØÃWæ\ÃsS?½ïGmhO3Jê¹§)ûäa/§tR¡AºÕÿê4ÿÿ° Kñ9ãÉD}E/BçGüÜgnÅÚ9ô3/çÀ4è± ßKÎóÎ3¸õxÏ´sÜz¸ãî¨7iÓUØ¶ÔHuç¢:J4Ðar0YÆA¾¼O1lKz²E½±íZJ2`Aà5²ÆÅz±0}K!tÌwþl¢T`Dñ(4UÕæ!Fæ@ÜDÔ&ÿ®\|iª¡ý-Vôü>ê;ÂxkßÀ#3J$UnT¸?µÝòg\ç4&Ú3\|Fuw¤e«ãè £èn¢±>v5å.góFÃ\|,¡9UF~£ÇÖ¡.]PÓ0ÿoÚLåÂÆC°âæêÁ'=`SËJ¤øÒ´B\|×°'ëQ(÷«¹yl)2Ô;<÷Fýä@ÊZ%×ïÅÈÄ,Qñ´=Ï£¥£PöaS;qî.Øy´}R¤à1ÔwxS±¢ RðÈ/½î5~èÛSôÆ§S½ÜÁÙ`É5Utàô¶oý«õ`6¡âòí¦a:Æ¦m!Åcà}²{îa¯Mme®2@¾@£xbÈ^¥i>JÃå)¤±JõòÓÂ3²ÝÞo<BNPòÁbVlÎ_%Ïòrøß>Ûãù´s·äîu±ü¿c\£RôKêüM¡³¾n>÷D»5Öèõ\|9!! ÊrjH«·öã^4Ì»¢ûö©[{ ÁáâàÜxÅbýD^W·Ñà§ÃêAu»vÂiâ7ÎÕèç~¨±+¹±¼ôà~\| yì8Eõ¾¹?äµ÷¼F+>`V\|B.?AVbad_exception@std@@\|B.?AVexception@std@@\|B.?AVtype_info@@ base_address: 0x0042b000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: 0 H`à}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042e000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x0042f000 process_identifier: 2764 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2764 process_handle: 0x0000011c	1	1
NtSetContextThread Nov. 10, 2023, 9:26 a.m.	registers.eip: 1995571652 registers.esp: 2686564 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2764	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2764	1	0
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2964 thread_handle: 0x0000002c process_identifier: 2960 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000011c	1	1
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2960 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000011c	1	0
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁ ²à0À¬Þ à@ À@@ÞKàN© H.text¾ À `.rsrcN©àªÂ@@.reloc l@B base_address: 0x00400000 process_identifier: 2960 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x00402000 process_identifier: 2960 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x0042e000 process_identifier: 2960 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: Ð> base_address: 0x0043a000 process_identifier: 2960 process_handle: 0x0000011c	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2960 process_handle: 0x0000011c	1	1
NtSetContextThread Nov. 10, 2023, 9:26 a.m.	registers.eip: 1995571652 registers.esp: 2554404 registers.edi: 0 registers.eax: 4382350 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000274 suspend_count: 1 process_identifier: 2960	1	0
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c	1	0
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000394 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000003c8 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000450 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000048c suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000004c0 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000004e0 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000004f8 suspend_count: 1 process_identifier: 2960	1	0
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c	1	0
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000004f0 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000004e0 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000488 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000003bc suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000424 suspend_count: 1 process_identifier: 2960	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000029c suspend_count: 1 process_identifier: 3020	1	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.hc
McAfee	Trojan-FVTT!2C1702EC1CE5
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005aad751 )
K7GW	Trojan ( 005aad751 )
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.GPXR
APEX	Malicious
Kaspersky	UDS:Trojan-PSW.Win32.Stealerc.gen
Rising	Trojan.Generic@AI.100 (RDML:ezOOwkutQgvB/NWigGzdgw)
Sophos	ML/PE-A
DrWeb	Trojan.Inject4.63861
TrendMicro	TrojanSpy.Win32.TRICKBOT.SMC
Trapmine	malicious.moderate.ml.score
SentinelOne	Static AI - Malicious SFX
Google	Detected
Varist	W32/Kryptik.JKR.gen!Eldorado
Antiy-AVL	Trojan/Win32.PossibleThreat
Gridinsoft	Spy.Win32.Redline.lu!heur
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
ZoneAlarm	UDS:Trojan-PSW.Win32.Stealerc.gen
Microsoft	Trojan:Script/Phonzy.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
DeepInstinct	MALICIOUS
Cylance	unsafe
TrendMicro-HouseCall	TrojanSpy.Win32.TRICKBOT.SMC
Ikarus	Trojan.Spy.Stealer
Fortinet	W32/Kryptik.HUTD!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.56b5be
Avast	Win32:PWSX-gen [Trj]

from.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All